Issues

• chore(security): enable private vulnerability reporting

  choresecurity
  FerrLabs/Kit#364 · Filter by author BryanFRD opened on Oct 23, 2026

• docs: align readme and crate docs with what middleware and mail ship

  documentation
  FerrLabs/Kit#363 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(auth): keep user_agent and ip when rotating a session

  bug
  FerrLabs/Kit#362 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(license): require a seat count when minting customer licenses

  bug
  FerrLabs/Kit#361 · Filter by author BryanFRD opened on Oct 23, 2026

• chore(deps): update ctutils, rustls-webpki and webpki-roots for new rustsec advisories

  dependenciessecurity
  FerrLabs/Kit#360 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(webhooks): reject empty hmac secrets and bound the delivery store

  bugsecurity
  FerrLabs/Kit#359 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(vault): reject secret paths that escape the kv mount

  bugsecurity
  FerrLabs/Kit#358 · Filter by author BryanFRD opened on Oct 23, 2026

• feat(crypto): zeroize keks, deks and cached plaintext

  enhancementsecurity
  FerrLabs/Kit#357 · Filter by author BryanFRD opened on Oct 23, 2026

• fix: set connect and request timeouts on oauth, vault and github http clients

  bug
  FerrLabs/Kit#356 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(oauth): redact client_secret and pkce verifier from Debug output

  security
  FerrLabs/Kit#355 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(cache): release the swr lock only when the caller still owns it

  bug
  FerrLabs/Kit#354 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(queue): make worker shutdown return while a job is in flight

  bug
  FerrLabs/Kit#353 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(queue): guard job state updates and stop the sweeper stranding jobs

  bug
  FerrLabs/Kit#352 · Filter by author BryanFRD opened on Oct 23, 2026

• security(http): review address filtering in SafeHttpClient

  security
  FerrLabs/Kit#351 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(oauth): validate id_token iss against the issuer exactly as discovered

  bug
  FerrLabs/Kit#350 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(oauth): expire the cached oidc jwks so dropped keys stop verifying

  bugsecurity
  FerrLabs/Kit#349 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(auth): return the matched totp step so callers can reject replayed codes

  bugsecurity
  FerrLabs/Kit#348 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(permissions): keep staff:access out of full_session and the wildcard

  bugsecurity
  FerrLabs/Kit#347 · Filter by author BryanFRD opened on Oct 23, 2026

• chore(api): ferrlabs-http exists, and two products rolled their own SSRF client instead

  FerrLabs/Kit#296 · Filter by author BryanFRD opened on Sep 20, 2026

• chore: drop the legacy async-stripe TLS stack so deny.toml can stop ignoring eight advisories

  FerrLabs/Kit#260 · Filter by author BryanFRD opened on Sep 3, 2026
  1

• fix(release): a newly added package inherits the whole repo history and its breaking changes

  FerrLabs/Kit#222 · Filter by author BryanFRD opened on Aug 16, 2026

• feat(auth): JWKS client so products verify central tokens without holding a key

  FerrLabs/Kit#221 · Filter by author BryanFRD opened on Aug 16, 2026
  1

• feat(ci): report Kit-crate drift across consumers — ferrlabs-auth is two majors behind in FerrGrowth and nothing flags it

  FerrLabs/Kit#202 · Filter by author BryanFRD opened on Aug 8, 2026

• feat(ratelimit): the crate has zero consumers while three APIs hand-roll their own — and none survive a second replica

  FerrLabs/Kit#201 · Filter by author BryanFRD opened on Aug 8, 2026

• feat(middleware): add a CatchPanicLayer — a handler panic currently drops the connection with no response, no 500, no metric

  FerrLabs/Kit#200 · Filter by author BryanFRD opened on Aug 8, 2026