Issues

SR-002: SSRF address-guard skipped behind proxies

brave/bravebot#4061 · opened

on Nov 13, 2026

SR-001: install.sh fails open when `gpg` is absent

brave/bravebot#4060 · opened

on Nov 13, 2026

1

Audit unsuccessful automatic and requested compaction outcomes

brave/bravebot#4059 · opened

on Nov 13, 2026

The terminal plan approval prompt prints the plan as raw markdown on one line with no scroll, so a long plan is cut off and the approve and keep-planning choices are hidden

brave/bravebot#4055 · opened

on Nov 13, 2026

PERM-12: the desktop bridge reads readsStayInWorkspace again on every turn, so removing it from a settings file widens an open session's file reads

brave/bravebot#4049 · opened

on Nov 13, 2026

PERM-1/PERM-3/PERM-5/SANDBOX-24/SANDBOX-25/SERVERS-12/BACKEND-36/BACKEND-48/DELEGATE-19: tracking the sweep that followed #4029, where a restriction a person or an administrator writes misses what it is meant to restrict and nothing says so

brave/bravebot#4041 · opened

on Nov 12, 2026

1

A key written twice in a settings file or `managed.json` keeps only its last value without a report, so `"models": {"deny": [...]}` followed by `"models": {}` refuses nothing

brave/bravebot#4039 · opened

on Nov 12, 2026

BACKEND-36/RUN-28/SANDBOX-25: a restriction that names nothing is not reported: a misspelled key inside `permissions`, `sandbox.filesystem` or `run`, Claude Code's `disableBypassPermissionsMode`, a `scrubEnv` name with trailing whitespace, a `$HOME` path

brave/bravebot#4038 · opened

on Nov 12, 2026

DELEGATE-19: a definition's `disallowedTools` or `permissionMode` is ignored without a notice, so a delegate written to be read-only keeps `run` and `write_file`

brave/bravebot#4037 · opened

on Nov 12, 2026

SANDBOX-25: a `denyRead` glob compares names exactly on a volume that folds case and Unicode form, so `**/*.pem` holds back nothing over `SERVER.PEM` on macOS

brave/bravebot#4036 · opened

on Nov 12, 2026

BACKEND-48: a background session started again by `bravebot reply` or the supervisor skips the managed model refusal, so turns go to a model `models.deny` refuses

brave/bravebot#4035 · opened

on Nov 12, 2026

BACKEND-48: a `models.deny` entry naming a ChatGPT or xAI account model as the account is sent it, such as `gpt-5`, does not refuse `chatgpt/gpt-5`, so the denied model is requested

brave/bravebot#4034 · opened

on Nov 12, 2026

PERM-3/PERM-7: a path rule naming a directory without `/**`, or holding `..`, is read without a report and misses the files it names, so `Read(./secrets/)` in deny lets `read_file secrets/key` through

brave/bravebot#4033 · opened

on Nov 12, 2026

PERM-5: a `Bash(...)` rule holding shell quotes, a backslash escape, two spaces or an NFD program name is read without a report and never matches, so `Bash(sh -c "*")` in deny refuses nothing

brave/bravebot#4032 · opened

on Nov 12, 2026

SERVERS-12: an `mcp.deny` entry the managed reader cannot use, such as `{"host": "fd00::1"}` or `{"command": ["evil-server"]}`, is skipped without a report, so the administrator's deny refuses nothing

brave/bravebot#4030 · opened

on Nov 12, 2026

SANDBOX-28: on macOS a bypass run cannot start once its write rows outgrow the argument limit, because the Seatbelt profile is passed to sandbox-exec as one argument

brave/bravebot#4025 · opened

on Nov 12, 2026

socket_standing_at binds through a link in TMPDIR, so tests that use it fail with SUN_LEN where TMPDIR is long

brave/bravebot#4023 · opened

on Nov 12, 2026

A run refusal inside a $(...) substitution gives its offset within the substituted text instead of the whole command line, so the planner is pointed at the wrong column

brave/bravebot#4022 · opened

on Nov 12, 2026

Recover bounded case, extension and typo variants in read_file without disclosing filenames

brave/bravebot#4019 · opened

on Nov 12, 2026

SANDBOX-29: a program inside $(...) that cannot be confined is reported with the may-have-run-in-part text and no route, and makes no request for no sandbox

brave/bravebot#4018 · opened

on Nov 12, 2026

LIST-5: list_files caps the files it takes from one directory but not the subdirectories, so a directory of thousands of subdirectories still fills the 2000-entry cap and hides the rest of the tree

brave/bravebot#4017 · opened

on Nov 12, 2026

TRUST-10: a link inside an added directory is refused with a remedy chosen from its target, so a planted link decides the /add-dir or drop advice the planner reads

brave/bravebot#4016 · opened

on Nov 12, 2026

CMDLINE-4/CMDLINE-8: a glob in an unvouched directory that matches nothing leaves its word unmarked, so whether a name exists there decides whether the line is asked about and whether its output reaches the planner as trusted

brave/bravebot#4015 · opened

on Nov 12, 2026

LSP-3: an lsp answer asked at a position in an unvouched file is trusted when it names only vouched files, so that file decides which locations the planner reads as trusted text

brave/bravebot#4014 · opened

on Nov 12, 2026

DELEGATE-29/PROC-16: a processor answer length reaches a budgeted delegate as its token figure and decides when it loses its tools, so an unvouched file sets a number the planner reads

brave/bravebot#4013 · opened

on Nov 12, 2026

Navigation Menu

Repository navigation

Issues

SR-002: SSRF address-guard skipped behind proxies

SR-001: install.sh fails open when `gpg` is absent

Audit unsuccessful automatic and requested compaction outcomes

The terminal plan approval prompt prints the plan as raw markdown on one line with no scroll, so a long plan is cut off and the approve and keep-planning choices are hidden

PERM-12: the desktop bridge reads readsStayInWorkspace again on every turn, so removing it from a settings file widens an open session's file reads

PERM-1/PERM-3/PERM-5/SANDBOX-24/SANDBOX-25/SERVERS-12/BACKEND-36/BACKEND-48/DELEGATE-19: tracking the sweep that followed #4029, where a restriction a person or an administrator writes misses what it is meant to restrict and nothing says so

A key written twice in a settings file or `managed.json` keeps only its last value without a report, so `"models": {"deny": [...]}` followed by `"models": {}` refuses nothing

BACKEND-36/RUN-28/SANDBOX-25: a restriction that names nothing is not reported: a misspelled key inside `permissions`, `sandbox.filesystem` or `run`, Claude Code's `disableBypassPermissionsMode`, a `scrubEnv` name with trailing whitespace, a `$HOME` path

DELEGATE-19: a definition's `disallowedTools` or `permissionMode` is ignored without a notice, so a delegate written to be read-only keeps `run` and `write_file`

SANDBOX-25: a `denyRead` glob compares names exactly on a volume that folds case and Unicode form, so `**/*.pem` holds back nothing over `SERVER.PEM` on macOS

BACKEND-48: a background session started again by `bravebot reply` or the supervisor skips the managed model refusal, so turns go to a model `models.deny` refuses

BACKEND-48: a `models.deny` entry naming a ChatGPT or xAI account model as the account is sent it, such as `gpt-5`, does not refuse `chatgpt/gpt-5`, so the denied model is requested

PERM-3/PERM-7: a path rule naming a directory without `/**`, or holding `..`, is read without a report and misses the files it names, so `Read(./secrets/)` in deny lets `read_file secrets/key` through

PERM-5: a `Bash(...)` rule holding shell quotes, a backslash escape, two spaces or an NFD program name is read without a report and never matches, so `Bash(sh -c "*")` in deny refuses nothing

SERVERS-12: an `mcp.deny` entry the managed reader cannot use, such as `{"host": "fd00::1"}` or `{"command": ["evil-server"]}`, is skipped without a report, so the administrator's deny refuses nothing

SANDBOX-28: on macOS a bypass run cannot start once its write rows outgrow the argument limit, because the Seatbelt profile is passed to sandbox-exec as one argument

socket_standing_at binds through a link in TMPDIR, so tests that use it fail with SUN_LEN where TMPDIR is long

A run refusal inside a $(...) substitution gives its offset within the substituted text instead of the whole command line, so the planner is pointed at the wrong column

Recover bounded case, extension and typo variants in read_file without disclosing filenames

SANDBOX-29: a program inside $(...) that cannot be confined is reported with the may-have-run-in-part text and no route, and makes no request for no sandbox

LIST-5: list_files caps the files it takes from one directory but not the subdirectories, so a directory of thousands of subdirectories still fills the 2000-entry cap and hides the rest of the tree

TRUST-10: a link inside an added directory is refused with a remedy chosen from its target, so a planted link decides the /add-dir or drop advice the planner reads

CMDLINE-4/CMDLINE-8: a glob in an unvouched directory that matches nothing leaves its word unmarked, so whether a name exists there decides whether the line is asked about and whether its output reaches the planner as trusted

LSP-3: an lsp answer asked at a position in an unvouched file is trusted when it names only vouched files, so that file decides which locations the planner reads as trusted text

DELEGATE-29/PROC-16: a processor answer length reaches a budgeted delegate as its token figure and decides when it loses its tools, so an unvouched file sets a number the planner reads