Issues

• Security: authoritative deployment and residency inventory (S0 baseline for the 356 claims)

  security
  CedynGroup/aequorOS#757 · Filter by author delaanthonio opened on Oct 31, 2026

• Security: enforce TLS 1.3 minimum at the edge and on all internal service hops

  security
  CedynGroup/aequorOS#752 · Filter by author delaanthonio opened on Oct 31, 2026
  1

• Delivery: enforce the public two-person return-signing outcome

  compliance
  CedynGroup/aequorOS#715 · Filter by author delaanthonio opened on Oct 30, 2026

• Delivery: regenerate historical regulatory returns exactly

  compliance
  CedynGroup/aequorOS#714 · Filter by author delaanthonio opened on Oct 30, 2026

• Delivery: prove immutable lineage for every reported figure

  compliance
  CedynGroup/aequorOS#713 · Filter by author delaanthonio opened on Oct 30, 2026

• [P3] [security] Verify staged-upload size/SHA at document complete-upload

  pythonsecurity
  CedynGroup/aequorOS#712 · Filter by author delaanthonio opened on Oct 29, 2026

• [P3] [security] Sanitize Content-Disposition filename on ICAAP attachment downloads

  pythonsecurity
  CedynGroup/aequorOS#711 · Filter by author delaanthonio opened on Oct 29, 2026

• [P3] [security] Confirm the intended role floor for operator inspector FIX endpoints

  pythonsecurity
  CedynGroup/aequorOS#710 · Filter by author delaanthonio opened on Oct 29, 2026

• [P3] [security] Add per-IP throttling to tenant login (unknown emails unthrottled)

  pythonsecurity
  CedynGroup/aequorOS#709 · Filter by author delaanthonio opened on Oct 29, 2026

• [P3] [security] Escape ODBC/JDBC connection-string values before interpolation

  pythonsecurity
  CedynGroup/aequorOS#708 · Filter by author delaanthonio opened on Oct 29, 2026

• [P3] [security] Cap push-batch page byte size, not just record count

  pythonsecurity
  CedynGroup/aequorOS#707 · Filter by author delaanthonio opened on Oct 29, 2026

• [P3] [security] Pin the gitleaks release with a checksum in secret-scan.yml

  github_actionssecurity
  CedynGroup/aequorOS#706 · Filter by author delaanthonio opened on Oct 29, 2026

• [P3] [security] Add rate limiting to the marketing contact endpoint

  javascriptsecurity
  CedynGroup/aequorOS#705 · Filter by author delaanthonio opened on Oct 29, 2026

• [P3] [security] Seal the aeq-impersonation cookie before proxy.ts trusts its presence

  javascriptsecurity
  CedynGroup/aequorOS#704 · Filter by author delaanthonio opened on Oct 29, 2026

• [P2] [security] Harden claude-review.yml: prompt-injected PR can win agent approval and auto-merge

  github_actionssecurity
  CedynGroup/aequorOS#703 · Filter by author delaanthonio opened on Oct 29, 2026

• [P2] [security] Cap xlsx expansion when parsing tenant uploads (zip-bomb DoS)

  pythonsecurity
  CedynGroup/aequorOS#702 · Filter by author delaanthonio opened on Oct 29, 2026

• [P2] [security] Upload routes buffer the whole file before enforcing the 50 MB cap

  pythonsecurity
  CedynGroup/aequorOS#701 · Filter by author delaanthonio opened on Oct 29, 2026

• [P2] [security] Escape officer names before reportlab Paragraph markup (SSRF into filed PDF)

  pythonsecurity
  CedynGroup/aequorOS#700 · Filter by author delaanthonio opened on Oct 29, 2026

• Engineering: inventory feature dependencies and shadow impacted-test selection before enforcement

  testing
  CedynGroup/aequorOS#690 · Filter by author delaanthonio opened on Oct 29, 2026

• BoG evidence: counsel wording and submission caveats

  compliancelegal
  CedynGroup/aequorOS#651 · Filter by author delaanthonio opened on Oct 26, 2026

• BoG evidence: assurance, privacy and development access gaps

  compliancesecurity
  CedynGroup/aequorOS#650 · Filter by author delaanthonio opened on Oct 26, 2026

• BoG evidence: incident notice, exit and recovery gaps

  complianceplatform
  CedynGroup/aequorOS#649 · Filter by author delaanthonio opened on Oct 26, 2026

• BoG evidence: encryption and key custody gaps

  compliancesecurity
  CedynGroup/aequorOS#648 · Filter by author delaanthonio opened on Oct 26, 2026

• BoG evidence: staff and bank-user access gaps

  complianceidentity
  CedynGroup/aequorOS#647 · Filter by author delaanthonio opened on Oct 26, 2026

• BoG evidence: confirm hosting, sub-processors and data flows

  complianceplatform
  CedynGroup/aequorOS#646 · Filter by author delaanthonio opened on Oct 26, 2026