Issues

• [Bug] Command Center Platform Pulse calculates Total Users from Vendor namespaces instead of User accounts

  GenAI-Security-Project/finbot-ctf#600 · Filter by author prince-shakyaa opened on Oct 15, 2026

• Example: capability-scoped tools as a defense track

  GenAI-Security-Project/finbot-ctf#591 · Filter by author d8joseph opened on Oct 7, 2026

• Unresolvable vendor_id / invoice_id in task_data escapes the agent loop's error handling

  GenAI-Security-Project/finbot-ctf#589 · Filter by author Prasad-desh opened on Oct 4, 2026
  1

• [Bug] BCC Recipients Can See Each Other's Addresses in FinMail

  GenAI-Security-Project/finbot-ctf#585 · Filter by author prince-shakyaa opened on Sep 24, 2026

• Bug_212_MUST_FIX: AUTH-QA-007 — Returning users who open the magic link in a different browser are redirected to /portals but left signed out; the middleware overwrites their new session cookie with the temp session sign-in just deleted

  GenAI-Security-Project/finbot-ctf#583 · Filter by author steadhac opened on Sep 16, 2026

• Bug_211_MUST_FIX: AUTH-QA-001 — GET /auth/verify consumes the token and signs in the requester, so any automated fetch locks the real user out and, on an account's first sign-in, takes it over

  GenAI-Security-Project/finbot-ctf#582 · Filter by author steadhac opened on Sep 16, 2026

• Bug: Command Center excludes zero-second completions from average solve time

  GenAI-Security-Project/finbot-ctf#556 · Filter by author DevaanshPathak opened on Aug 4, 2026
  1

• [Bug] MCP Tool Override Only Applies description - parameters Silently Dropped

  GenAI-Security-Project/finbot-ctf#547 · Filter by author prince-shakyaa opened on Jul 22, 2026
  1

• [Security] Unauthenticated MCP Tool Poisoning via Dark Lab Supply-Chain API

  GenAI-Security-Project/finbot-ctf#544 · Filter by author prince-shakyaa opened on Jul 14, 2026

• [Security] Unauthenticated SSRF via Guardrail Webhook URL : No URL Validation, No Auth Required

  GenAI-Security-Project/finbot-ctf#535 · Filter by author prince-shakyaa opened on Jul 3, 2026

• Adversarial coverage sweep: uncovered attack variants in two detectors

  GenAI-Security-Project/finbot-ctf#528 · Filter by author genesisadversary opened on Jun 9, 2026
  1

• [Bug] Guardrail webhook payload truncated mid-JSON before signing: body is unparseable but HMAC passes, and after_tool hook skipped for complete_task

  GenAI-Security-Project/finbot-ctf#525 · Filter by author prince-shakyaa opened on Jun 5, 2026
  1

• Fix Test Failures - Module Initialization and Schema Validation Errors

  GenAI-Security-Project/finbot-ctf#519 · Filter by author Jean-Regis-M opened on May 30, 2026

• [Bug / Security] Dead Auth Guard in Challenge Check & Hint Endpoints: Anonymous Sessions Bypass Attempt Tracking and Hint Consumption

  GenAI-Security-Project/finbot-ctf#514 · Filter by author prince-shakyaa opened on May 28, 2026
  1

• [Bug / Security] CTF Sidecar Widget Endpoint Missing Authentication Enforcement: Anonymous Sessions Bypass Auth Guard

  GenAI-Security-Project/finbot-ctf#511 · Filter by author prince-shakyaa opened on May 23, 2026
  1

• [Bug] Profile Share-Card Cache Collision: Incomplete Cache Key Causes Stale Card Served After Avatar/Bio Change

  GenAI-Security-Project/finbot-ctf#508 · Filter by author prince-shakyaa opened on May 22, 2026

• [Security] HTTPS Validation Bypass in User Profile Updates Leads to SSRF via Insecure Avatar URLs

  GenAI-Security-Project/finbot-ctf#506 · Filter by author prince-shakyaa opened on May 19, 2026
  4

• [Security] CSRF Token Exposed in JSON Response & Missing Content-Security-Policy Header

  GenAI-Security-Project/finbot-ctf#503 · Filter by author prince-shakyaa opened on May 18, 2026
  1

• [Security] Missing Input Validation, Rate Limiting, and Insecure DEBUG Default

  GenAI-Security-Project/finbot-ctf#501 · Filter by author prince-shakyaa opened on May 16, 2026
  4

• [Backend] Insecure defaults: SESSION_COOKIE_SECURE=False and ProxyHeadersMiddleware trusts all hosts

  GenAI-Security-Project/finbot-ctf#498 · Filter by author prince-shakyaa opened on May 15, 2026
  20

• [Bug]: Mobile Navigation Sidebar unresponsive in Admin and Dark Lab Portals

  GenAI-Security-Project/finbot-ctf#493 · Filter by author prince-shakyaa opened on May 8, 2026

• UI/UX: Implement Responsive Mobile Navigation Menu

  GenAI-Security-Project/finbot-ctf#489 · Filter by author prince-shakyaa opened on May 7, 2026

• [UI/UX] Fix Mobile Responsiveness and Initial Viewport Scaling on Landing Page

  GenAI-Security-Project/finbot-ctf#487 · Filter by author prince-shakyaa opened on May 6, 2026

• Add New Challenge: Poisoned Handoff (Multi-Agent Trust Exploitation)

  GenAI-Security-Project/finbot-ctf#486 · Filter by author syedDS opened on May 1, 2026
  1

• Bug: LLM_PROVIDER=ollama undocumented — app crashes with "Unsupported LLM provider: ollama"

  GenAI-Security-Project/finbot-ctf#480 · Filter by author aminrj opened on Apr 16, 2026