Issues

• Paid access vs paid work — comparing notes on agent settlement

  wienerlabs/covenant#322 · Filter by author source-origin opened on Sep 19, 2026

• Optimistic settlement + arbitration — how do you handle disputes?

  wienerlabs/covenant#321 · Filter by author PalabreX opened on Sep 8, 2026

• Replace Float math with fixed-point arithmetic in dispute bond calculations

  wienerlabs/covenant#320 · Filter by author kh0ra opened on Jul 9, 2026

• SEC-64 [info]: finalize_payment / resolve_dispute manually deserialize claim_listing

  security
  wienerlabs/covenant#312 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-63 [info]: escrow/build advertises demoMode unconditionally with no onchain guard

  security
  wienerlabs/covenant#311 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-62 [info]: Raw SQL queries reviewed — no SQL injection found (parameterized / sta

  security
  wienerlabs/covenant#310 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-61 [low]: Bond token account in resolve_dispute is not mint-validated

  security
  wienerlabs/covenant#309 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-60 [low]: accept_job allows the poster to accept their own job as taker

  security
  wienerlabs/covenant#308 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-59 [low]: init_config accepts unbounded/unsafe parameters (no upper bound on bon

  security
  wienerlabs/covenant#307 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-58 [low]: x402 payer attribution uses 'largest debit' heuristic, allowing payer

  security
  wienerlabs/covenant#306 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-57 [low]: Revenue amount derived by float division can drift from the verified a

  security
  wienerlabs/covenant#305 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-56 [low]: Split dispute resolution lets a malicious arbitrator-quorum overpay ta

  security
  wienerlabs/covenant#304 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-55 [low]: Dispute bond uses non-atomic Float math with a tolerance window; tiny

  security
  wienerlabs/covenant#303 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-54 [low]: Admin data-dump endpoint runs four fully unbounded findMany (no take)

  security
  wienerlabs/covenant#302 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-53 [low]: In-memory rate-limit Map is per-serverless-instance and trivially bypa

  security
  wienerlabs/covenant#301 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-52 [low]: battle/predict GET loads all predictions for a user-controlled battleI

  security
  wienerlabs/covenant#300 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-51 [low]: GET/POST /api/keys signed message is replayable for ~the timestamp win

  security
  wienerlabs/covenant#299 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-50 [low]: Admin routes fall back to CRON_SECRET as the admin bearer — broad cred

  security
  wienerlabs/covenant#298 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-49 [low]: /api/health returns raw dependency error messages (DB/RPC) to unauthen

  security
  wienerlabs/covenant#297 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-48 [low]: Unauthenticated /api/metrics is open-by-default and exposes internal b

  security
  wienerlabs/covenant#296 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-47 [low]: Access-Control-Allow-Origin: * on /api/version leaks deployment topolo

  security
  wienerlabs/covenant#295 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-46 [low]: Unbounded findMany returns entire PublishedAgent table on public GET

  security
  wienerlabs/covenant#294 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-45 [low]: Markdown image src in chat rendered without scheme validation

  security
  wienerlabs/covenant#293 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-44 [low]: hosted-agents/avatar trusts client-declared MIME type for image valida

  security
  wienerlabs/covenant#292 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets
  

• SEC-43 [low]: x402 payment is bound to (agentId, message) but not to the paying call

  security
  wienerlabs/covenant#291 · Filter by author kh0ra opened on Jun 21, 2026 · M6 Security & secrets