Skip to content

docs: ArcReel GHSA-5r36-2f3p-5q87 published, fixed in v0.31.0 (25th fix) #158

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
elfrost merged 1 commit into from
Sep 23, 2026
Merged

docs: ArcReel GHSA-5r36-2f3p-5q87 published, fixed in v0.31.0 (25th fix) #158

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions docs/fixed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
---
layout: default
title: Findings a maintainer fixed
description: "The 24 scans in the AI PatchLab series where the maintainer shipped a fix — what was reported, and what landed upstream."
description: "The 25 scans in the AI PatchLab series where the maintainer shipped a fix — what was reported, and what landed upstream."
---

# Findings a maintainer fixed

Of 105 scans, **24** ended with a maintainer shipping a fix. This page is the
Of 109 scans, **25** ended with a maintainer shipping a fix. This page is the
short version of the argument: a report is only worth writing if someone can act on it.

The fastest turnaround in the series was about six hours from filing to a merged pull
Expand All @@ -26,6 +26,7 @@ release notes.
| 2026-08-12 | [jgravelle/jcodemunch-mcp](scans/jgravelle-jcodemunch-mcp.html) | 49 | 0 real |
| 2026-08-08 | [theroyallab/tabbyAPI](scans/theroyallab-tabbyapi.html) | 18 | 2 real |
| 2026-08-07 | [huangruiteng/loopx](scans/huangruiteng-loopx.html) | 57 | 1 real — withheld |
| 2026-08-04 | [ArcReel/ArcReel](scans/arcreel-arcreel.html) | 82 | 1 real — withheld |
| 2026-08-03 | [the-momentum/open-wearables](scans/the-momentum-open-wearables.html) | 145 | 2 real |
| 2026-07-29 | [Project-N-E-K-O/N.E.K.O](scans/project-n-e-k-o-n-e-k-o.html) | 783 | 1 real |
| 2026-07-28 | [EvoScientist/EvoScientist](scans/evoscientist-evoscientist.html) | 39 | 1 real |
Expand Down
8 changes: 4 additions & 4 deletions docs/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
layout: default
title: AI PatchLab Scans
description: "109 curated security scans of open-source AI agents, MCP servers and LLM apps - 24 confirmed fixes, run local-first with Semgrep, Gitleaks, Trivy and pip-audit."
description: "109 curated security scans of open-source AI agents, MCP servers and LLM apps - 25 confirmed fixes, run local-first with Semgrep, Gitleaks, Trivy and pip-audit."
---

# AI PatchLab Scans
Expand All @@ -20,7 +20,7 @@ remediation and confidence rules to normalize the findings.

> **Want this run privately against your own codebase?** I do independent
> security review of AI agents, MCP servers, and LLM apps —
> [**work with me →**]({{ '/work-with-me' | relative_url }}). 109 scans, 24 confirmed fixes, methodology in the open.
> [**work with me →**]({{ '/work-with-me' | relative_url }}). 109 scans, 25 confirmed fixes, methodology in the open.

> **OpenAI just launched [Daybreak](https://openai.com/index/daybreak-securing-the-world/) and Patch the Planet.**
> Same remediation loop, opposite trade-off: their path is a cloud frontier model;
Expand All @@ -35,7 +35,7 @@ remediation and confidence rules to normalize the findings.

## Two shorter ways in

- [**Findings a maintainer fixed**]({{ '/fixed' | relative_url }}) — the 24 that resolved
- [**Findings a maintainer fixed**]({{ '/fixed' | relative_url }}) — the 25 that resolved
upstream. The shortest version of the argument: a report is only worth writing if someone
can act on it.
- [**Scans that found nothing**]({{ '/clean' | relative_url }}) — 40 of them, published as
Expand Down Expand Up @@ -160,7 +160,7 @@ filed, which is the usual outcome of a clean scan.
| 2026-08-07 | [huangruiteng/loopx](scans/huangruiteng-loopx.html) | 57 | 1 real — withheld | **fixed** |
| 2026-08-06 | [nottelabs/notte](scans/nottelabs-notte.html) | 226 | 1 real — withheld | private |
| 2026-08-05 | [Vexa-ai/vexa](scans/vexa-ai-vexa.html) | 297 | 1 real — withheld | private |
| 2026-08-04 | [ArcReel/ArcReel](scans/arcreel-arcreel.html) | 82 | 1 real — withheld | private |
| 2026-08-04 | [ArcReel/ArcReel](scans/arcreel-arcreel.html) | 82 | 1 real — withheld | **fixed** |
| 2026-08-03 | [the-momentum/open-wearables](scans/the-momentum-open-wearables.html) | 145 | 2 real | **fixed** |
| 2026-08-02 | [Observal/Observal](scans/observal-observal.html) | 1,117 | 1 real — withheld | private |
| 2026-08-01 | [repowise-dev/repowise](scans/repowise-dev-repowise.html) | 86 | 2 real — withheld | private |
Expand Down
Loading
Loading