Zach Daniel / Ash Project

AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details

AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash