Search results

security: dependency version pinning — loose caret ranges allow silent vulnerability introduction

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#10 In KozyOps/semantic-release-clickup;

· SippieCup opened on Mar 7, 2026

security: CLICKUP_TOKEN sent as raw Authorization header value instead of Bearer scheme

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#9 In KozyOps/semantic-release-clickup;

· SippieCup opened on Mar 7, 2026

security: no HTTP 429 rate-limit handling — silent failures when ClickUp throttles requests

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#8 In KozyOps/semantic-release-clickup;

· SippieCup opened on Mar 7, 2026

security: function templates in plugin config allow arbitrary code execution

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#7 In KozyOps/semantic-release-clickup;

· SippieCup opened on Mar 7, 2026

security: commit subjects and author names inserted into markdown messages without escaping

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#6 In KozyOps/semantic-release-clickup;

· SippieCup opened on Mar 7, 2026

security: messageType validation inconsistency — 'update' is a valid type but fails verifyConditions

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#5 In KozyOps/semantic-release-clickup;

· SippieCup opened on Mar 7, 2026

security: no timeout on ClickUp API HTTP requests — CI pipeline can hang indefinitely

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#4 In KozyOps/semantic-release-clickup;

· SippieCup opened on Mar 7, 2026

security: sensitive error response body logged verbatim and included in thrown errors

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#3 In KozyOps/semantic-release-clickup;

· SippieCup opened on Mar 7, 2026

security: URL injection via unvalidated workspaceId and channelId

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#2 In KozyOps/semantic-release-clickup;

· SippieCup opened on Mar 7, 2026