Issues

[Bug][Medium] compose() drops property modifications when a node is moved in the later diff (modify→move chain)
HexaField/graphcoder#12 · opened on Sep 24, 2026
[Audit][Low+Info bundle] Six lower-severity findings from the GraphCoder red-team audit
HexaField/graphcoder#11 · opened on Sep 24, 2026
[Security][Medium] Client URL params trigger automatic, state-changing server calls (drive-by open, PR-stack import writes, unbounded flow-trace loop)
HexaField/graphcoder#10 · opened on Sep 24, 2026
[Security][Medium] Unauthenticated annotation writes persist unlimited attacker-shaped files into the git-tracked .graphcoder store
HexaField/graphcoder#9 · opened on Sep 24, 2026
[Security][Medium] /api/graph/trace-flow-reverse enumerates all simple paths with attacker-controlled maxDepth — exponential DoS
HexaField/graphcoder#8 · opened on Sep 24, 2026
[Security][Medium] WebSocket endpoint: no origin check, no maxPayload, unvalidated view_request params (server-side ReDoS via glob patterns)
HexaField/graphcoder#7 · opened on Sep 24, 2026
[Security][Medium] Unbounded JSON bodies + unbounded per-request work on /api/git/diff — remote DoS
HexaField/graphcoder#6 · opened on Sep 24, 2026
[Security][Medium] .graphcoder/config.json AI provider config spawns arbitrary local processes; request body selects the entry
HexaField/graphcoder#5 · opened on Sep 24, 2026
[Security][High] No authentication, wildcard CORS, 0.0.0.0 bind — plus Vite dev/preview on 0.0.0.0 with allowedHosts:true
HexaField/graphcoder#4 · opened on Sep 24, 2026
[Security][High] Annotation/conversation id used unvalidated in filesystem paths — arbitrary file read (GET), arbitrary file delete (DELETE)
HexaField/graphcoder#3 · opened on Sep 24, 2026
[Security][Critical] Unauthenticated POST /api/projects/open accepts any filesystem path — full source disclosure + worktree writes on the developer's machine
HexaField/graphcoder#2 · opened on Sep 24, 2026