Zach Daniel / Ash Project

ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Ash.Reactor change step fails open, skipping a change when its where guard raises