All pull requests

Pull requests

• fix(auth): sign in via POST so link prefetches can't use magic links

  #584·steadhac opened Sep 17, 2026·

  ·
  2

  1

• feat:Add MCP scenario module with tool poisoning, policy misconfig, detectors and CTF challenges

  #581·nitinawari opened Aug 22, 2026·

  ·

• fix: reject whitespace-only task_summary in orchestrator context capture (#459)

  #580·Deez-Automations opened Aug 20, 2026·

  ·
  1

  1

• fix: guard vendor_id/invoice_id=None in chat assistant tool callables (#418)

  #579·Deez-Automations opened Aug 20, 2026·

  ·
  1

  1

• Fix: profile share-card cache key omits fields that affect the render

  #578·Deez-Automations opened Aug 20, 2026·

  ·
  1

• Fix: Dark Lab tool override silently drops parameters/inputSchema

  #577·Deez-Automations opened Aug 20, 2026·

  ·
  2

• Fix: guardrail payload corruption before signing + missing after_tool for complete_task

  #576·Deez-Automations opened Aug 20, 2026·

  ·
  1

• Fix: DNS-based SSRF bypass in guardrail webhook URL validation

  #575·Deez-Automations opened Aug 19, 2026·

  ·
  1

• Fix: orchestrator confirms payment to vendor even when it fails

  #574·Deez-Automations opened Aug 19, 2026·

  ·
  7

• feat(trace): add investigation submission endpoint and The Debrief challenge

  #573·stealthwhizz opened Aug 17, 2026·

  ·
  3

• feat(trace): add ContextInjectionDetector with 14 tests

  #572·stealthwhizz opened Aug 17, 2026·

  ·

• feat(trace): add The Canary honeypot challenge

  #571·stealthwhizz opened Aug 17, 2026·

  ·

• docs(trace): add multi-step challenge authoring guide

  #570·stealthwhizz opened Aug 17, 2026·

  ·

• feat(trace): add Canary throughput and Delegation Audit overhead benchmarks

  #569·stealthwhizz opened Aug 17, 2026·

  ·

• feat(trace): add regression tests for 13 pre-existing detectors

  #568·stealthwhizz opened Aug 17, 2026·

  ·

• GSoC 2026 Final Submission: OWASP FinBot CTF — Challenge Library, Rate Limiting, MCP Server, Bug Fixes

  #567·ashike24 opened Aug 12, 2026·

  ·

• feat(labs): add defensive Guardrail blue challenge pack

  #566·nitinawari opened Aug 11, 2026·

  ·

• fix(mcp): reject negative limit in FinStripe list_transfers

  #565·Deez-Automations opened Aug 11, 2026·

  ·
  1

  6

• fix(mcp): reject negative mock_balance in FinStripe get_account_balance

  #564·Deez-Automations opened Aug 11, 2026·

  ·
  1

  6

• fix(mcp): persist vendor_account on FinStripe transfers

  #563·Deez-Automations opened Aug 11, 2026·

  ·
  1

  1

• fix(data): raise clear error instead of crashing on missing invoice dates

  #562·Deez-Automations opened Aug 11, 2026·

  ·
  2

  1

• fix(mcp): reject control characters in FinDrive filenames

  #561·Deez-Automations opened Aug 11, 2026·

  ·
  1

  6

• Week 11: Fix API error responses in mounted sub-apps + challenge contributor guide

  #560·ashike24 opened Aug 10, 2026·

  ·
  2

• Week 9-10: Integration testing + fix chat stream error handling

  #559·ashike24 opened Aug 7, 2026·

  ·
  2

• feat(ctf): Cross-Vendor Email (BOLA/IDOR, ASI-03)

  #558·Deez-Automations opened Aug 4, 2026·

  ·
  8