Issues

• security(preauth): version the SDK key format

  kind:refactorphase:server
  nubster-opensources/flaps#157 · Filter by author pierrick-fonquerne opened on Jul 24, 2026 · Backlog

• security(preauth): resolve the rate-limiter client address through a trusted-proxy allowlist

  kind:chorephase:server
  nubster-opensources/flaps#156 · Filter by author pierrick-fonquerne opened on Jul 24, 2026 · Backlog

• security(release): scan container images and attest SBOM and build provenance

  kind:chorephase:release
  nubster-opensources/flaps#147 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• security(repo): enforce secret protection and required security checks

  kind:chorephase:docsphase:release
  nubster-opensources/flaps#146 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• test(security): run authenticated DAST and HTTP abuse cases against ephemeral deployments

  kind:chorephase:serverphase:store
  nubster-opensources/flaps#145 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• test(fuzz): fuzz parsers and protocol decoders on pull requests and schedules

  kind:chorephase:clientphase:evalphase:server
  nubster-opensources/flaps#144 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• security(ci): gate untrusted pull requests with automated security analysis

  kind:chorephase:release
  nubster-opensources/flaps#143 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• security(config): validate and support rotation of HMAC key material

  kind:chorephase:docsphase:serverphase:store
  nubster-opensources/flaps#142 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• feat(auth): add bearer-session logout, revocation and expiry cleanup

  kind:featurephase:serverphase:store
  nubster-opensources/flaps#141 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• security(ofrep): prevent shared client-key rate-limit starvation

  kind:bugphase:server
  nubster-opensources/flaps#140 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• security(secrets): redact SDK keys and database credentials from Debug output

  kind:bugphase:clientphase:server
  nubster-opensources/flaps#139 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• security(client): bound ruleset, SSE and snapshot input sizes

  kind:bugphase:client
  nubster-opensources/flaps#138 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• security(ci): pin GitHub Actions and reusable workflows by immutable SHA

  kind:chorephase:release
  nubster-opensources/flaps#137 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• security(server): require an explicit secure transport posture for non-loopback deployments

  kind:chorephase:docsphase:server
  nubster-opensources/flaps#136 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• security(bootstrap): stop exposing the initial administrator password in process logs

  kind:bugphase:docsphase:serverphase:store
  nubster-opensources/flaps#135 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.1.0: Headless MVP

• docs(ops): document OIDC configuration, recovery and production feedback

  documentationphase:docsphase:release
  nubster-opensources/flaps#130 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC

• test(e2e): cover OIDC and admin UI across supported databases

  kind:chorephase:serverphase:store
  nubster-opensources/flaps#129 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC

• security(web): harden browser routes, headers and reverse-proxy deployment

  kind:chorephase:docsphase:server
  nubster-opensources/flaps#128 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC

• feat(audit): expose and display paginated admin audit history

  kind:featurephase:serverphase:store
  nubster-opensources/flaps#127 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC

• feat(ui): manage SDK keys with one-time secret handling

  kind:featurephase:server
  nubster-opensources/flaps#126 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC

• feat(ui): manage reusable segments and preview targeting validation

  kind:featurephase:server
  nubster-opensources/flaps#125 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC

• feat(ui): manage projects, environments, flags and environment configurations

  kind:featurephase:server
  nubster-opensources/flaps#124 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC

• feat(ui): embed a configurable server-rendered admin shell

  kind:featurephase:server
  nubster-opensources/flaps#123 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC

• feat(web): add secure browser sessions, logout and CSRF protection

  kind:featurephase:server
  nubster-opensources/flaps#122 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC

• feat(auth): enforce OIDC admission policy and preserve break-glass local access

  kind:featurephase:serverphase:store
  nubster-opensources/flaps#121 · Filter by author pierrick-fonquerne opened on Jul 22, 2026 · v0.2.0: Admin UI and OIDC