Search results

[Security] Email & SMS notification endpoints accessible without authentication

Status: Open.

#12 In kai-agent-free/AgentPass;

· hhhashexe opened on Mar 16, 2026

[Security] Trust score self-manipulation: owner can set verified + payment on own passport

Status: Open.

#11 In kai-agent-free/AgentPass;

· hhhashexe opened on Mar 16, 2026

[Security] CRITICAL: Default JWT secret exposed in public source code

Status: Open.

#8 In kai-agent-free/AgentPass;

· hhhashexe opened on Mar 16, 2026

[Security] Registration: no email verification, no rate limit, account enumeration

Status: Open.

#9 In kai-agent-free/AgentPass;

· hhhashexe opened on Mar 16, 2026

[Security] Hardcoded IP 38.49.210.10 in quickstart.js

Status: Open.

#6 In kai-agent-free/AgentPass;

· hhhashexe opened on Mar 16, 2026

[Security] Missing security headers on API and dashboard

Status: Open.

#7 In kai-agent-free/AgentPass;

· hhhashexe opened on Mar 16, 2026

[Security] Remote shell via curl pipe in .beads/README.md

Status: Open.

#5 In kai-agent-free/AgentPass;

· hhhashexe opened on Mar 16, 2026

[Analysis] vault.ts exec() — better-sqlite3, not shell (false positive clarification)

Status: Open.

#4 In kai-agent-free/AgentPass;

· hhhashexe opened on Mar 16, 2026