Search results

feat: enable JWT validation in hooks mode (PreToolUse)

enhancementNew feature or requestNew feature or request

Status: Open.

#48 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 30, 2026

fix: ephemeral JWT keys are unverifiable after process exit — no external audit trail

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#45 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 22, 2026

feat: embed grant scopes in JWT claims for per-request grant enforcement

enhancementNew feature or requestNew feature or request

Status: Open.

#44 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 22, 2026

feat: move JWT auth from _token parameter to HTTP Authorization header

enhancementNew feature or requestNew feature or request

Status: Open.

#43 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 22, 2026

fix: get_token endpoint has no authentication — bootstrap problem

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#42 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 22, 2026

feat: JWT token refresh, rotation, and revocation

enhancementNew feature or requestNew feature or request

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#41 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 22, 2026

fix: attestation signing path does not validate JWT — signing key separation incomplete

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#40 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 22, 2026

fix: hooks mode JWT is issued but never validated — PreToolUse has no token check

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#39 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 22, 2026

fix: sublayout security model largely unimplemented — no namespacing, constraint enforcement, or recursive verification

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#26 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 11, 2026

fix: identity discovery uses spoofable process-tree heuristics, not SO_PEERCRED

bugSomething isn't workingSomething isn't working

securitySecurity vulnerability or concernSecurity vulnerability or concern

Status: Open.

#24 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 11, 2026

feat: implement gRPC evaluators for custom verification logic

enhancementNew feature or requestNew feature or request

verification

Status: Open.

#21 In aflock-ai/aflock;

· manzil-infinity180 opened on Mar 10, 2026