Issues

• Messages sent right after the WebSocket opens are silently dropped (REQ gets no EOSE, EVENT gets no OK)

  bug
  cameri/nostream#1044 · Filter by author vitorpamplona opened on Nov 3, 2026
  1

  

• A probe alert that fails to save is lost for that transition

  cameri/nostream#1040 · Filter by author chappie-daemon opened on Nov 2, 2026

• A settings save can undo an admin moderation ban

  cameri/nostream#1039 · Filter by author chappie-daemon opened on Nov 2, 2026

• Upgrade astro in website/site: 5.14 carries a critical RCE and three highs

  cameri/nostream#1037 · Filter by author chappie-daemon opened on Nov 2, 2026
  1

• Port the behaviour behind nip77, peering, subscription plans and the probe/SSL notifications

  cameri/nostream#1036 · Filter by author chappie-daemon opened on Nov 2, 2026

• relay: a refusal re-pin needs three edits and the third is held by nothing

  bugfactoryrewriterust
  cameri/nostream#1032 · Filter by author chappie-daemon opened on Nov 1, 2026 · Phase 2: Protocol core

• relay: the module doc credits the encoder/decoder pair for a consistency only the pin test holds

  documentationfactoryrewriterust
  cameri/nostream#1027 · Filter by author chappie-daemon opened on Nov 1, 2026 · Phase 2: Protocol core

• Security: 9 low-severity findings across admin, adapters, payments and compose

  security
  cameri/nostream#1022 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: 7 low-severity findings in the CLI

  security
  cameri/nostream#1021 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: 6 low-severity findings in the message handlers and event strategies

  security
  cameri/nostream#1020 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: 16 low-severity findings in services, repositories and utils

  security
  cameri/nostream#1019 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: weak cryptography in src/cli/commands/setup.ts

  securityvulnerability
  cameri/nostream#1018 · Filter by author chappie-daemon opened on Nov 1, 2026
  3

• Security: idor in src/services/payments-service.ts

  securityvulnerability
  cameri/nostream#1017 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: broken auth in src/admin/password-admin-auth-provider.ts

  securityvulnerability
  cameri/nostream#1016 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: sensitive data exposure in src/handlers/request-handlers/rate-limiter-middleware.ts

  securityvulnerability
  cameri/nostream#1015 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: authorization bypass in src/utils/settings.ts

  securityvulnerability
  cameri/nostream#1014 · Filter by author chappie-daemon opened on Nov 1, 2026

• relay: the settings validator must own the ceiling, not just the floor

  factoryrewriterust
  cameri/nostream#998 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  2

• relay: on a semantically rejected settings document, the bound report is silently dropped

  factoryrewriterust
  cameri/nostream#994 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  2

• relay: one address can exhaust the shared frame budget below its own socket cap

  factoryrewriterust
  cameri/nostream#992 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 1: Rust foundation

• relay: two sentences around the CLOSE-during-mint test claim more than it proves

  bugfactoryrewriterust
  cameri/nostream#984 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  1

• relay: the invite-mint-plus-CLOSE combination is covered by no test at the wire

  bugfactoryrewriterust
  cameri/nostream#983 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  1

• relay: a close-aborts-read test stays green under the delay it exists to catch

  bugfactoryrewriterust
  cameri/nostream#982 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  1

• Port the capture aborted-union detail: a wrong-typed field answers Invalid input, not the field message

  bugrewriterust
  cameri/nostream#979 · Filter by author chappie-daemon opened on Oct 25, 2026

• relay: a publish racing a kind-62 vanish request survives it

  bugfactoryneeds-adrrewriterust
  cameri/nostream#975 · Filter by author chappie-daemon opened on Oct 24, 2026 · Phase 2: Protocol core
  1

• relay: extra frame elements are ignored where the capture rejects them

  bugfactoryrewriterust
  cameri/nostream#961 · Filter by author chappie-daemon opened on Oct 24, 2026 · Phase 2: Protocol core
  1