Search results

ci: pre-commit --all-files newly red repo-wide from linter version drift (unpinned pylint/astroid under pylint-odoo)

Status: Open.

#361 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_api_v2_simulation): analytics API computes unpublished statistics (no is_published_api allowlist) [Severity: Medium]

Status: Open.

#360 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_programs): Program Validator still carries Tier-2 registry viewer (Registry Search menu) [Severity: Low]

Status: Open.

#355 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_scoring): scoring viewers read all scoring results incl. registrant name + snapshot PII [Severity: Medium]

Status: Open.

#354 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_cel_domain): replace DCI sensitive-metric predicate denylist with an AST-level allowlist [Severity: Medium]

Status: Open.

#350 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_dci_indicators): precompute/fetch_values route bypasses DCI-sync access gate [Severity: Medium]

Status: Open.

#349 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_cel_domain): blanket base.group_user revoke on spp.data.value breaks DRIMS KPI computes [Severity: High if DRIMS-only roles exist]

Status: Open.

#348 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_cr_type_assign_program): program_id not frozen post-submit — applied program can differ from the approved one [Severity: Medium]

Status: Open.

#347 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_change_request_v2): free diff-padding evades duplicate detection once #264 and #343 both land [Severity: Low-Medium]

Status: Open.

#346 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(demo): default-credential users unguarded in spp_mis_demo_v2/spp_grm_demo/spp_drims_sl(_demo); + data->demo restructure [Severity: Medium]

Status: Open.

#345 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_change_request_v2): writable selected_field_name can steer dynamic-approval routing [Severity: Medium]

Status: Open.

#344 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_registry_search): un-sudo'd sub-searches 500 for roles without ACL on phone/ID co-models [Severity: Low]

Status: Open.

#340 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 23, 2026