Issues

• Make owasp-kb doctor check Codex installs, not only Claude Code

  enhancement
  Feature

  Crimson7research/owasp-kb#98 · Filter by author Yimura opened on Nov 5, 2026
  1

• Register the ASVS agents on Codex so the assessment skills run

  enhancement
  Feature

  Crimson7research/owasp-kb#96 · Filter by author Yimura opened on Nov 5, 2026
  2

• OpenCode install: the ASVS assessment skills depend on agents, hooks and state the install does not provide

  bug
  Bug

  Crimson7research/owasp-kb#95 · Filter by author Yimura opened on Nov 5, 2026
  1

• Codex install: install the plugin natively and document that the assessment skills need agents

  bug
  Bug

  Crimson7research/owasp-kb#94 · Filter by author Yimura opened on Nov 5, 2026
  2

• Search AISVS requirements by control name through Appendix B

  enhancement
  Feature

  Crimson7research/owasp-kb#88 · Filter by author Yimura opened on Nov 5, 2026
  1

• A safety classifier blocked late chapter dispatches, losing 29 requirements to a coverage gap

  Crimson7research/owasp-kb#85 · Filter by author Yimura opened on Nov 3, 2026

• docs/publishing.md says plugins/** is baked into the Docker image, but .dockerignore excludes it

  documentation
  Task

  Crimson7research/owasp-kb#73 · Filter by author Yimura opened on Sep 8, 2026

• The assessment skills name a <scripts> token the Codex and OpenCode installs cannot expand

  documentationenhancement
  Feature

  Crimson7research/owasp-kb#71 · Filter by author Yimura opened on Sep 8, 2026

• Parity is red on master: squash-merging a workflow change invalidates its translation stamp

  bug
  Bug

  Crimson7research/owasp-kb#69 · Filter by author Yimura opened on Sep 8, 2026

• Verify the three trigger-gated jobs actually run on Blacksmith, GHCR push included

  Crimson7research/owasp-kb#67 · Filter by author Yimura opened on Sep 8, 2026
  2

• The truncated-chunk gate measures a char/4 proxy, not the tokenizer that truncates

  bug
  Bug

  Crimson7research/owasp-kb#62 · Filter by author Yimura opened on Sep 8, 2026

• Serve mobile implementation guidance from MASTG, as the cheat sheets serve ASVS

  enhancement
  Feature

  Crimson7research/owasp-kb#61 · Filter by author Yimura opened on Sep 8, 2026

• owasp_related accepts a cheat sheet doc_key and returns nothing, blaming partial coverage

  Crimson7research/owasp-kb#52 · Filter by author Yimura opened on Aug 11, 2026

• Discovery data: layers 1-3 missed a security-relevant refactor, and the corpus arrived confirmatory

  Crimson7research/owasp-kb#51 · Filter by author Yimura opened on Aug 11, 2026

• Make reproduction the refutation standard

  enhancement
  Crimson7research/owasp-kb#47 · Filter by author Yimura opened on Aug 6, 2026

• A retracted claim about over-refusal is still cited as precedent in gate_triage_on_inventory

  documentation
  Crimson7research/owasp-kb#41 · Filter by author Yimura opened on Aug 6, 2026
  1

• Grep's type filter is never evaluated, the same defect as #33 in another field

  bug
  Crimson7research/owasp-kb#40 · Filter by author Yimura opened on Aug 6, 2026
  1

• Exclusion hook over-refuses when the search root is known

  enhancement
  Crimson7research/owasp-kb#38 · Filter by author Yimura opened on Aug 5, 2026
  1

• Assessment scope is absent from the finder and refuter prompts

  bug
  Crimson7research/owasp-kb#35 · Filter by author Yimura opened on Aug 5, 2026

• Untracked and gitignored files are treated as admissible evidence

  bug
  Crimson7research/owasp-kb#34 · Filter by author Yimura opened on Aug 5, 2026
  1

• Nothing prunes the plugin cache, and commit-keyed versions make it grow per merge

  Crimson7research/owasp-kb#30 · Filter by author Yimura opened on Aug 4, 2026

• download_model.py has no retry, and a partial download is cached as complete

  Crimson7research/owasp-kb#26 · Filter by author Yimura opened on Aug 4, 2026

• Move CI to the org's self-hosted runners, except where a job needs to run a container it just built

  Crimson7research/owasp-kb#12 · Filter by author Yimura opened on Aug 3, 2026
  3

  

• The COPY parser reads physical lines, so the Dockerfile may not wrap

  Crimson7research/owasp-kb#9 · Filter by author Yimura opened on Aug 3, 2026

• An L2 assessment costs 151 subagents and must start in a fresh session; the skills never say so

  Crimson7research/owasp-kb#5 · Filter by author Yimura opened on Aug 3, 2026