| #102 |
FTX-102: a RunFlow binding accepts a credential that cannot see its own workflow
EARS SPEC:
- When a RunFlow binding is created, Futex shall verify that the supplied credential can ...
|
closed |
high |
2026-07-31 19:57 |
- |
|
| #101 |
FTX-101: audit harness mints a platform key per run and never revokes it — 10 active platform-admin keys on prod
EARS SPEC:
- When the audit harness finishes, it shall revoke every credential it created.
- Futex s...
|
closed |
high |
2026-07-31 19:22 |
- |
|
| #100 |
FTX-100: last_used_at is never written — the API reports a permanently-null field operators use to triage keys
EARS SPEC:
- When an API key successfully authenticates a request, Futex shall record the time of us...
|
closed |
medium |
2026-07-31 18:29 |
- |
|
| #99 |
FTX-99: WEBHOOK_ALLOW_HOSTS is inert for bare hosts — allowlist only matches host:port entries
EARS SPEC:
- Where a host is listed in WEBHOOK_ALLOW_HOSTS without a port, the Futex SSRF guard shal...
|
closed |
high |
2026-07-31 18:15 |
- |
|
| #98 |
FTX-98: RunFlow 409 is two different answers; treating both as idempotent success absorbs a misrouted approval
EARS SPEC:
- When RunFlow answers a node approve/reject call with HTTP 409 and detail not_awaiting_a...
|
closed |
high |
2026-07-31 18:06 |
- |
|
| #97 |
FTX-97: purge foreign/legacy RunFlow credentials from bindings; sync worker must skip disabled bindings
EARS SPEC:
- The Futex RunFlow sync worker shall not call RunFlow for a binding whose status is not ...
|
closed |
high |
2026-07-31 17:25 |
- |
|
| #96 |
FTX-96: new-tenant auth namespaces are strict by default (auth 3.0.0) — member provisioning 409s
EARS SPEC:
- When Futex provisions the first member of a tenant whose auth namespace was created aft...
|
closed |
high |
2026-07-31 17:09 |
- |
|
| #95 |
FTX-95: Adopt RunFlow auth-issued (rak_) keys after phase-3 cutover; purge committed RunFlow credential
EARS SPEC:
- The Futex RunFlow integration shall authenticate to RunFlow using an auth-issued API ke...
|
closed |
high |
2026-07-31 17:00 |
- |
|
| #93 |
Audit remediation: SSRF allowlist, freepass sub-addressing, concurrent provisioning race, per-IP rate limit
EARS SPEC:
- While FUTEX_ENV=prod, the system shall block private/loopback/reserved IPs on all user-...
|
closed |
high |
2026-07-30 00:40 |
- |
|
| #87 |
FTX-87: blank policy_name will 422 ~8% of HITL notifications under mail-api strict rendering
EARS SPEC:
Context: mail-api deployed strict rendering for TRANSACTIONAL template sends on
2026-07-...
|
closed |
high |
2026-07-26 19:09 |
- |
|
| #86 |
FTX-86: RunFlow reconcile — terminal-state widening + unobservable-binding backstop
EARS SPEC:
Context: RunFlow shipped their commit f13e238 (Option 2) — DELETE now terminalizes
non-t...
|
closed |
high |
2026-07-26 18:59 |
- |
|
| #84 |
FTX-84: 500 instead of 422 envelope on unparseable request body
EARS SPEC:
- If a request body cannot be parsed or validated (including non-JSON or non-UTF-8 bytes ...
|
closed |
high |
2026-07-26 04:13 |
- |
|