active 2026-01-16 → 2026-02-16 (UTC)
Activity over time
Daily event counts in the loaded window
Line chart, 32 days from 2026-01-16 to 2026-02-16. Pushes: 22 total, peak 7 in a day. Pull requests: 0 total, peak 0 in a day. Issues: 73 total, peak 34 in a day. Comments: 24 total, peak 12 in a day. Stars: 0 total, peak 0 in a day.
- Pushes
- Pull requests
- Issues
- Comments
- Stars
Stars, PRs, issues and forks are under-captured in the later part of this window. GH Archive progressively stopped capturing non-push events during 2026 — −95% or worse by the end of the window. Every series here except Pushes fades for that reason, so a decline above reflects the archive, not this repository. Pushes stay reliable throughout, so read them, and the contributor counts derived from them, as the real signal. Data health has the measurements.
Top contributors
Pushes, PRs, issues, reviews and comments — stars and forks excluded, so this is contribution rather than popularity
| Contributor | Contributions | Pushes | PRs | Comments |
|---|---|---|---|---|
| sploithunter | 119 | 22 | 0 | 24 |
Recent activity
Latest issues, pull requests and releases
- Issue#13sploithunter2026-02-16 16:26[P2] Unsanitized image filenames allow path traversal in prompt attachments
- Issue#12sploithunter2026-02-16 16:26[P4] Docs: Document full issue-agent CLI option set
- Issue#15sploithunter2026-02-16 16:26[P3] Projects autocomplete incorrectly resolves ~/ paths
- Issue#22sploithunter2026-02-16 16:26[P4] Docs: Document webhook secret requirement for issue-worker
- Issue#24sploithunter2026-02-16 16:26[P3] Invalid CIN_MAX_EVENTS disables event history truncation
- Issue comment#10sploithunter2026-02-16 16:25[P2] Poller does not clean up when prompt send returns false
- Issue#32sploithunter2026-02-16 16:24[P2] Shell injection via unquoted gh command strings in issue agents
- Issue comment#33sploithunter2026-02-16 16:24[P3] Directory boundary check uses startsWith and allows prefix-based path traversal
- Issue comment#35sploithunter2026-02-16 16:24[P2] Unauthenticated API access allows remote session/control operations
- Issue comment#38sploithunter2026-02-16 16:24[P2] Issue Creator leaves feedback sessions stuck after prompt send failure
- Issue comment#41sploithunter2026-02-16 16:24[P3] Codex watcher keeps deleted or stale session files in tracked set
- Issue comment#44sploithunter2026-02-16 16:24[P4] maxConcurrentSessions cap ignores already-active sessions
- Issue#48sploithunter2026-02-16 16:24[P2] Session file explorer allows symlink-based path escape
- Issue comment#50sploithunter2026-02-16 16:24[P2] Unauthenticated /sessions/:id/focus executes shell via unescaped tmuxPane from /event
- Issue#51sploithunter2026-02-16 13:11[P2] Unsanitized image filename allows path traversal in prompt image upload
- Issue#39sploithunter2026-02-16 11:11[P2] Unsanitized image filename enables arbitrary file write via /sessions/:id/prompt
- Issue comment#39sploithunter2026-02-16 11:11[P2] Unsanitized image filename enables arbitrary file write via /sessions/:id/prompt
- Issue#49sploithunter2026-02-16 11:08[P4] Stale session token entries persist after session deletion
- Issue#49sploithunter2026-02-16 11:08[P4] Stale session token entries persist after session deletion
- Issue#48sploithunter2026-02-16 11:08[P2] Session file explorer allows symlink-based path escape
- Issue#39sploithunter2026-02-16 11:01[P2] Unsanitized image filename enables arbitrary file write via /sessions/:id/prompt
- Issue#39sploithunter2026-02-16 11:01[P2] Unsanitized image filename enables arbitrary file write via /sessions/:id/prompt
- Issue comment#38sploithunter2026-02-16 09:12[P2] Issue Creator leaves feedback sessions stuck after prompt send failure
- Issue#47sploithunter2026-02-16 09:09[P4] Docs: start-agents.sh usage and security requirements are undocumented
- Issue#46sploithunter2026-02-16 09:09[P4] start-agents.sh can kill unrelated processes via broad pkill patterns
Totals cover only the window loaded into ClickHouse and count events, not GitHub's lifetime totals — 0 stars here means stars gained during the window, not the repo's star count.