Search results

feat(api): trusted-proxy-aware client IP in traces & logs (+ gate trace-context propagation)

area/apiHTTP handlers, routing, middlewareHTTP handlers, routing, middleware

area/observabilityMetrics, logs, traces, health, profilingMetrics, logs, traces, health, profiling

documentationImprovements or additions to documentationImprovements or additions to documentation

enhancementNew feature or requestNew feature or request

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#333 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

epic(security): pre-authz existence oracles / info-leak — order authorization before existence checks

area/apiHTTP handlers, routing, middlewareHTTP handlers, routing, middleware

area/policyAccess control policies (Hasura-style)Access control policies (Hasura-style)

breaking-changeBreaking change to public API, CLI, or configBreaking change to public API, CLI, or config

enhancementNew feature or requestNew feature or request

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#327 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

epic(security): pre-launch DoS / resource-exhaustion hardening (global request + resource budget on /v1)

area/apiHTTP handlers, routing, middlewareHTTP handlers, routing, middleware

area/ingestIngest pipeline (Bento, batching, DLQ)Ingest pipeline (Bento, batching, DLQ)

area/observabilityMetrics, logs, traces, health, profilingMetrics, logs, traces, health, profiling

area/queryStructured query AST, SQL builderStructured query AST, SQL builder

breaking-changeBreaking change to public API, CLI, or configBreaking change to public API, CLI, or config

enhancementNew feature or requestNew feature or request

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#326 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

security(streaming): applyStreamPolicy passes non-EventMessage / empty table_name payloads through unfiltered (fail-open)

area/apiHTTP handlers, routing, middlewareHTTP handlers, routing, middleware

area/observabilityMetrics, logs, traces, health, profilingMetrics, logs, traces, health, profiling

area/policyAccess control policies (Hasura-style)Access control policies (Hasura-style)

bugSomething isn't workingSomething isn't working

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#323 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

security(query): InjectPermissionFilters splices the RLS predicate by first-substring match — crafted alias/column misplaces it

area/policyAccess control policies (Hasura-style)Access control policies (Hasura-style)

area/queryStructured query AST, SQL builderStructured query AST, SQL builder

bugSomething isn't workingSomething isn't working

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#322 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

security(pipes): cache key includes the inlined {{limit}} — varied numeric param bypasses cache/singleflight into uncapped aggregations

area/cacheLocal / shared / tiered cachingLocal / shared / tiered caching

area/pipesNamed query pipesNamed query pipes

enhancementNew feature or requestNew feature or request

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#321 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

security(auth): JWKS verification never validates aud/iss (no knob) — confused deputy on shared-IdP deployments

area/apiHTTP handlers, routing, middlewareHTTP handlers, routing, middleware

area/policyAccess control policies (Hasura-style)Access control policies (Hasura-style)

breaking-changeBreaking change to public API, CLI, or configBreaking change to public API, CLI, or config

enhancementNew feature or requestNew feature or request

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#320 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

security(streaming): SSE applies the column allowlist but not the policy row-filter — query/stream RLS drift

area/apiHTTP handlers, routing, middlewareHTTP handlers, routing, middleware

area/observabilityMetrics, logs, traces, health, profilingMetrics, logs, traces, health, profiling

area/policyAccess control policies (Hasura-style)Access control policies (Hasura-style)

bugSomething isn't workingSomething isn't working

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#319 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

security(policy): denied_aggregations bypassed by case (deny check runs before lowercasing fails open)

area/policyAccess control policies (Hasura-style)Access control policies (Hasura-style)

area/queryStructured query AST, SQL builderStructured query AST, SQL builder

bugSomething isn't workingSomething isn't working

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#318 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

security(query): ClickHouse resource caps not enforced server-side — send per-query Settings (max_execution_time/max_memory_usage/max_rows_to_read)

area/apiHTTP handlers, routing, middlewareHTTP handlers, routing, middleware

area/queryStructured query AST, SQL builderStructured query AST, SQL builder

bugSomething isn't workingSomething isn't working

enhancementNew feature or requestNew feature or request

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#316 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 10, 2026

Add deployment Environments (production + npm) with required reviewers and scoped secrets

area/infraCI, build, deploy, Docker, releaseCI, build, deploy, Docker, release

enhancementNew feature or requestNew feature or request

securitySecurity-sensitive issue or fixSecurity-sensitive issue or fix

Status: Open.

#306 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 9, 2026

OpenAPI spec for the WaveHouse API + machine-readable discovery (/.well-known/api-catalog)

area/apiHTTP handlers, routing, middlewareHTTP handlers, routing, middleware

area/docsDocumentation, site/, READMEDocumentation, site/, README

area/sdkTypeScript SDK (clients/ts/)TypeScript SDK (clients/ts/)

enhancementNew feature or requestNew feature or request

Status: Open.

#302 In Wave-RF/WaveHouse;

· EricAndrechek opened on Jun 8, 2026