Stopped zebrad-log-filter executing log text as shell
Reproduced a shell-injection path with a crafted log line, then rewrote the filter in pure Bash, so a malicious log line can no longer run commands on a node operator's machine.
Both security fixes in Zcash Zebra v6.2.2 first, then everything else I have sent upstream.
Reproduced a shell-injection path with a crafted log line, then rewrote the filter in pure Bash, so a malicious log line can no longer run commands on a node operator's machine.
Stopped the Elasticsearch password leaking into the startup config dump by wrapping it in a RedactedString type.
Both merged within 31 hours · Zebra v6.2.2 release notes ↗
88 merged · 5 open · synced hourly from GitHub
| Project | Contribution | Status |
|---|---|---|
| ZcashFoundation/zebra | Stopped zebrad-log-filter executing log text as shell (PR #11050) | ● Merged |
| ZcashFoundation/zebra | Kept the Elasticsearch password out of the config dump (PR #11051) | ● Merged |
| ZcashFoundation/zebra | Fixed six book instructions that fail or misinform (PR #10956) | ● Merged |
| zcash/librustzcash | Reconciled AGENTS.md with the README dependency diagram (PR #2624) | ● Merged |
| ZecHub/zechub | zcashd deprecation note in the Raspberry Pi 4 full-node guide (PR #1882) | ● Merged |
| ZecHub/zechub-wiki | Fixed the hackathon project list falling back to stale data (PR #652) | ● Merged |
| ethereum/ethereum-org-website | Clarified wording in the proof-of-stake developer docs (PR #12972) | ● Merged |
| ZcashFoundation/zebra | Refreshed book content overtaken by releases and refactors (PR #11216) | ● Merged |
| jinolabs-xyz/markov | fix(pine): every script is MPL 2.0 and published free, the source sale is gone (PR #514) | ● Merged |
| jinolabs-xyz/markov | fix(upgrade): phones hold the VAT lines' height, and an Elite open starts focus on the card (PR #510) | ● Merged |
| jinolabs-xyz/markov | fix(daily-content): daily cards carry the site's three-bar mark (PR #580) | ● Merged |
| jinolabs-xyz/markov | feat(chart): a result card from the figures a trader types (PR #522) | ● Merged |
| jinolabs-xyz/markov | fix(collector): a switched-off venue reads off in /health's sources and gaps (PR #532) | ● Merged |
| jinolabs-xyz/markov | fix(deps): mcp-markets takes zod 4.6 and body-parser 2.4, past two high advisories (PR #527) | ● Merged |
| jinolabs-xyz/markov | feat(app): the tools reopen on the picks a trader left them with (PR #504) | ● Merged |
| jinolabs-xyz/markov | feat(chart): share cards turn the move on screen into a story or post (PR #368) | ● Merged |
| jinolabs-xyz/markov | feat(landing): the hero's grid becomes a field of arrows that spark now and then (PR #369) | ● Merged |
| jinolabs-xyz/markov | chore(ci): a script test refuses any repo secret in a workflow or action but GITHUB_TOKEN (PR #524) | ● Merged |
| jinolabs-xyz/markov | docs(ship): a repeated lesson stays in the PR body, not appended to the shared entry (PR #523) | ● Merged |
| jinolabs-xyz/markov | docs(ops): the backup runbook removes old copies when the job stops or is uninstalled (PR #520) | ● Merged |
| jinolabs-xyz/markov | fix(devices): axe runs after the landing's scroll reveals have faded in (PR #508) | ● Merged |
| jinolabs-xyz/markov | test(billing): one webhook delivery id three times at once applies once (PR #505) | ● Merged |
| jinolabs-xyz/markov | fix(test): the session deadline test ticks once the lookup has started (PR #506) | ● Merged |
| jinolabs-xyz/markov | feat(ops): a sealed daily copy of the account tables outside Cloudflare (PR #515) | ● Merged |
| jinolabs-xyz/markov | feat(landing): the hero chart becomes a small editor once its build-up ends (PR #356) | ● Merged |
| jinolabs-xyz/markov | feat(chart): the chart image credits TradingView, as its licence asks (PR #362) | ● Merged |
| jinolabs-xyz/markov | fix(pine): the chart, code and copy name no website or paid script (PR #332) | ● Merged |
| jinolabs-xyz/markov | feat(chart): a chart image with the source of every layer in its footer (PR #334) | ● Merged |
| jinolabs-xyz/Otla-Dukaan | Team alerts: tell the team's phones when a chat needs a person (PR #78) | ● Merged |
| jinolabs-xyz/Otla-Dukaan | Live console, landing page, and a bot that understands before it acts (PR #77) | ● Merged |
| jinolabs-xyz/markov | fix(ci): the device check runs a pinned Chrome for Testing build (PR #276) | ● Merged |
| jinolabs-xyz/markov | feat(alerts): alerts delivered to Telegram and Discord (PR #13) | ● Merged |
| jinolabs-xyz/markov | docs: ARCHITECTURE and PRODUCT describe the live Markov (PR #41) | ● Merged |
| jinolabs-xyz/markov | docs: Institutional is gone from README and setup docs (PR #4) | ● Merged |
| jinolabs-xyz/markov | docs: README is Markov (PR #2) | ● Merged |
| jinolabs-xyz/markov | feat(ops): main changes only through a PR from staging (PR #1) | ● Merged |
| jinolabs-xyz/planc-studio | Add /services, tracked /go links for the PDFs, and drop "launching soon" (PR #9) | ● Merged |
| ZecHub/zechub-wiki | Replace blurry ZecHub title-bar banners with live HTML heroes (PR #802) | ● Merged |
| Entropy-LLP/bharattruck | docs(bible): §6.4 points at the seed script instead of restating passwords (PR #148) | ● Merged |
| jinolabs-xyz/planc-studio | Hero, careers, cookie consent, and Studio OG cards (PR #8) | ● Merged |
| Giri-Aayush/copynpaste | Remove em dashes from the keys and MCP page copy (PR #61) | ● Merged |
| Giri-Aayush/copynpaste | Fix the account dropdown clipping, and rebuild the MCP page into two altitudes (PR #59) | ● Merged |
| Giri-Aayush/copynpaste | Fix three real findings from the MCP stress test (PR #58) | ● Merged |
| Giri-Aayush/copynpaste | Reach the site Worker through a service binding, not its URL (PR #54) | ● Merged |
| Giri-Aayush/copynpaste | Namespace the MCP cached key by API host (PR #55) | ● Merged |
| Giri-Aayush/copynpaste | Open the pricing modal from the keys page instead of redirecting home (PR #60) | ● Merged |
| Giri-Aayush/copynpaste | Give the MCP server a front door: /mcp, and a way in from every surface (PR #57) | ● Merged |
| Giri-Aayush/copynpaste | Add a Humanize toggle that fixes em dashes and filler, with no AI provider (PR #49) | ● Merged |
| Giri-Aayush/copynpaste | Account-bound hashed API keys, a payment-gated MCP free tier, and a standalone MCP Worker (PR #53) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Record that a customer was emailed only when one actually was (#112) (PR #135) | ● Merged |
| jinolabs-xyz/Leads-dashboard | The lead panel on a phone: the title column was zero pixels wide (PR #134) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Nothing deletes a row, and the phone can read a lead card (PR #133) | ● Merged |
| jinolabs-xyz/Leads-dashboard | The proxy shipped as functions/, which that deploy command never compiles (PR #132) | ● Merged |
| jinolabs-xyz/Leads-dashboard | The session cookie was third-party, so browsers were dropping it (PR #131) | ● Merged |
| jinolabs-xyz/Leads-dashboard | A follow-up date cannot hold "call me Tuesday at 4" (PR #130) | ● Merged |
| jinolabs-xyz/Leads-dashboard | The local harness could not create a first account either (PR #129) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Make getting in possible without a shell (PR #128) | ● Merged |
| jinolabs-xyz/Leads-dashboard | A Team screen, because there was no way to add a person from the UI at all (PR #127) | ● Merged |
| jinolabs-xyz/Leads-dashboard | The bundle check failed because the string was there (PR #126) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Stop the deploy verification failing a deploy that worked (PR #125) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Let a human deploy without an account, deliberately and only by hand (PR #124) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Set the secret the way wrangler will actually accept (PR #122) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Put the two production preconditions where the credential actually is (PR #121) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Fix the frontend and triage half of the review findings (PR #120) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Fix eight defects an adversarial review found in the mail path (PR #119) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Write down how the mailer and the triage screen are turned on, and deploy them (PR #118) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Capture a lead in four fields and a paste, not twenty-one inputs (PR #117) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Follow-up triage: one queue, one key per lead — and equal access, asserted (PR #116) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Tier 3: mail that stays attached to its lead, so the queue stops lying (PR #115) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Tier 2: forward an email, get a lead (PR #114) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Tier 1: a morning digest that cannot send itself twice (PR #113) | ● Merged |
| jinolabs-xyz/Leads-dashboard | An outbound channel this repository does not have to name a provider for (PR #110) | ● Merged |
| jinolabs-xyz/Leads-dashboard | Let the trail record a delivery, and keep it unforgeable (PR #109) | ● Merged |
| Entropy-LLP/bharattruck | fix(app): add security response headers, clear all bt-app dependency advisories (PR #152) | ● Merged |
| Entropy-LLP/bharattruck | fix(db): 0033 enable RLS on the freight reference tables (confirmed exploitable) (PR #151) | ● Merged |
| Entropy-LLP/bharattruck | fix(booking,fleet,auth,app): close review C-1/C-2 remainders, S-7 actor+formats, S-6/S-2 UX (PR #150) | ● Merged |
| Entropy-LLP/bharattruck | fix(pricing,fleet,app): drop pilot platform fee, gate truck capacity, add read-only consolidation hint (PR #149) | ● Merged |
| Entropy-LLP/bharattruck | feat(db): 0030 one-live-trip-per-driver index, 0031 fleet GSTIN/PAN format checks (PR #147) | ● Merged |
| Entropy-LLP/bharattruck | fix(fleet): validate GSTIN and PAN by format, not by length (review S-7) (PR #146) | ● Merged |
| Entropy-LLP/bharattruck | fix(auctions): pin the action column on My bids (review S-6, corrected scope) (PR #145) | ● Merged |
| Entropy-LLP/bharattruck | fix(post): name the stale quote, and stop offering past pickup dates (review S-1/S-2) (PR #144) | ● Merged |
| Entropy-LLP/bharattruck | fix(dispatch): one driver, one live trip on the three solo paths (review C-2) (PR #140) | ● Merged |
| Entropy-LLP/bharattruck | fix(marketplace): nobody bids on the load they posted (review C-1) (PR #139) | ● Merged |
| Entropy-LLP/bharattruck | docs(pricing): engine P0–P4 status + P5 data dependency (PR #143) | ● Merged |
| Entropy-LLP/bharattruck | feat(pricing): justify-a-price (Mode B) — reverse breakdown for a self-named bid (P4) (PR #142) | ● Merged |
| Entropy-LLP/bharattruck | feat(pricing): quote↔floor↔market reconciliation + bt-app breakdown (P3) (PR #141) | ● Merged |
| Entropy-LLP/bharattruck | feat(pricing): FR8-calibrated market rate layer, directional (P2) (PR #138) | ● Merged |
| Entropy-LLP/bharattruck | feat(pricing): real road distance from tracking, haversine fallback (P1) (PR #137) | ● Merged |
| zcash/developers | Removed remaining ZenHub references (PR #88) | ○ Open |
| jinolabs-xyz/markov-tools | chore(ops): the assets-only Worker config and CI (PR #1) | ○ Open |
| jinolabs-xyz/markov-studio | Reels kit: markov-reels + reels-fork, one team skill with per-teammate copies (PR #1) | ○ Open |
| zodl-inc/zcash-docs | Bring the Light Client Development page up to 2026 (PR #12) | ○ Open |
| Giri-Aayush/copynpaste | Strip layout-escaping styles from pasted HTML so long pastes stay in the box (PR #69) | ○ Open |