Issues

• [Audit] Medium — Configuration is stored inside the installed package and rewritten non-atomically

  kaifcodec/user-scanner#731 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] Medium — Terminal output accepts raw control characters from local and remote data

  kaifcodec/user-scanner#730 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] Medium — Proxy “validation” uses attacker-modifiable plaintext HTTP

  good first issue
  kaifcodec/user-scanner#729 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] Medium — Rappi's loud behavior depends on process arguments, not scan policy

  good first issue
  kaifcodec/user-scanner#728 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] Medium — MCP cross-scan depth and sweep are unbounded

  kaifcodec/user-scanner#726 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] Medium — MCP scan inputs skip CLI validation and accept malformed or oversized targets

  kaifcodec/user-scanner#725 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] Medium — Browser-impersonation sessions and warm-up keys are unbounded and cross-scan

  kaifcodec/user-scanner#724 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] Medium — Persistent HTTP clients grow with proxy inputs and are never closed

  kaifcodec/user-scanner#723 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] High — Importing the email orchestrator globally monkey-patches all HTTPX clients

  kaifcodec/user-scanner#722 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] High — Self-update can remove the working install and still report success

  kaifcodec/user-scanner#721 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] High — Media downloads and image decoding have no byte or pixel budget

  kaifcodec/user-scanner#720 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] High — Media SSRF validation is vulnerable to DNS rebinding and proxy-resolution mismatch

  kaifcodec/user-scanner#719 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] High — MCP cancellation is deliberately suppressed until all scan work finishes

  kaifcodec/user-scanner#718 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] High — MCP callers can request effectively unbounded thread-pool creation

  kaifcodec/user-scanner#717 · Filter by author jsawyerdev opened on Oct 21, 2026
  2

  

• [Audit] High — A timed-out synchronous validator continues running and defeats concurrency limits

  kaifcodec/user-scanner#716 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] High — Bulk targets can escape the requested output path and overwrite arbitrary files

  kaifcodec/user-scanner#715 · Filter by author jsawyerdev opened on Oct 21, 2026

• [Audit] High — Library mode bypasses the loud-module safety gate

  kaifcodec/user-scanner#714 · Filter by author jsawyerdev opened on Oct 21, 2026

• Linux connection error

  kaifcodec/user-scanner#491 · Filter by author VamatoHD opened on Aug 2, 2026
  5