api(bounties): aggregates ignore repo visibility, exposing private-repo activity #477

Activity

1. beardthelion

   added

   crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

   kind:securityVulnerability fix or hardeningVulnerability fix or hardening

   sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

   subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

   subsystem:visibilityPath-scoped visibility and content withholdingPath-scoped visibility and content withholding

   on Sep 26, 2026
2. chenzeyan54-commits

   added a commit that references this issue on Sep 26, 2026

   fix(Twigpine#477): api(bounties): aggregates ignore repo visibility, …

   ...

   4332361
3. beardthelion

   added

   sev:mediumDegraded but workaround existsDegraded but workaround exists

   and removed

   sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

   on Sep 26, 2026
4. beardthelion commented on Sep 26, 2026

   

   beardthelion

   on Sep 26, 2026

   Collaborator

   More actions

   Recalibrating to sev:medium. The leak is aggregate-granularity: deltas over all-bounty stats with no repo identity disclosed. That is weaker than #341 (medium), where a stranger could distinguish a specific private-repo bounty from a nonexistent one. A fix is already open at #483.
5. Mystic-commits commented on Sep 27, 2026

   

   Mystic-commits

   on Sep 27, 2026

   More actions

   I've opened PR #495 to resolve this.

   Approach & Differentiators:

   • Zero N+1 DB Queries / No Table Walks: Mirrors the canonical stats() pattern (Unauthenticated GET /api/v1/stats leaks the count of private/mode-A repos (count oracle) #104, server.rs:546-570) by batch-loading repos and visibility rules once, evaluating listable_at_root in memory, and performing aggregation in PostgreSQL via unnest.
   • Fails Closed: Database errors collapse the visible set to empty, returning 0/empty without leaking private repo existence.
   • Includes Deny-Probe Tests: Added integration tests in crates/gitlawb-node/src/test_support.rs verifying anonymous probes cannot observe private repo bounties in global stats, leaderboard, or per-agent earnings.

   PR: #495
6. Mystic-commits

   added 3 commits that reference this issue on Sep 27, 2026

   fix(Twigpine#477): scope bounty aggregates to anonymously-listable repos

   ...

   5ff30ff

   fix(Twigpine#477): scope bounty aggregates to anonymously-listable repos

   ...

   a7a91f2

   fix(Twigpine#477): scope bounty aggregates to anonymously-listable repos

   ...

   7afd30b