Issues

• Cross-resource command impersonation via raw clientID event

  newcore-network/opencore#73 · Filter by author Jaro-c opened on Jul 18, 2026

• Unbounded array/string schemas allow DoS before the length check runs

  newcore-network/opencore#72 · Filter by author Jaro-c opened on Jul 18, 2026

• worker-pool uses new Function() for dynamic compute — RCE footgun

  newcore-network/opencore#70 · Filter by author Jaro-c opened on Jul 18, 2026

• npm publish missing --provenance flag in publish.yml

  newcore-network/opencore#69 · Filter by author Jaro-c opened on Jul 18, 2026

• Pin GitHub Actions to commit SHA instead of mutable tags

  newcore-network/opencore#68 · Filter by author Jaro-c opened on Jul 18, 2026

• Configure logging transports and flush strategy for non-dev

  newcore-network/opencore#6 · Filter by author Flussen opened on Dec 13, 2025

• Capture unhandled rejections and global errors

  newcore-network/opencore#5 · Filter by author Flussen opened on Dec 13, 2025

• Add configuration validation (fail-fast on bootstrap)

  newcore-network/opencore#3 · Filter by author Flussen opened on Dec 13, 2025