Search results

SECURITY: createMutedWordsRegExp accepts unbounded input, creates arbitrarily large regex

Status: Open.

#63 In hzrd149/applesauce;

· hzrd149 opened on Apr 1, 2026

SECURITY: fakeVerifyEvent exported as public API enables silent signature bypass

Status: Open.

#62 In hzrd149/applesauce;

· hzrd149 opened on Apr 1, 2026

SECURITY: Missing timeouts and response size limits on HTTP fetches (SSRF/DoS)

Status: Open.

#61 In hzrd149/applesauce;

· hzrd149 opened on Apr 1, 2026

SECURITY: isEvent() weak validation allows malformed events to pass type guard

Status: Open.

#60 In hzrd149/applesauce;

· hzrd149 opened on Apr 1, 2026

SECURITY: Negentropy decodeVarInt/encodeVarInt integer overflow via 32-bit shift

Status: Open.

#59 In hzrd149/applesauce;

· hzrd149 opened on Apr 1, 2026

SECURITY: Gift Wrap Seal Signature Verification Bypass (NIP-59)

Status: Open.

#58 In hzrd149/applesauce;

· hzrd149 opened on Apr 1, 2026