All issues

Search results

[Bug] Contact honeypot returns a 400 that reveals the trap instead of faking success

Status: Open.

#322 In Rucha-Ambaliya/PrivGPT-Studio;

· vedant7007 opened on Aug 9, 2026

[Bug] Duplicate CORS registration — wildcard CORS(app) overrides the localhost-only /api/* policy

Status: Open.

#321 In Rucha-Ambaliya/PrivGPT-Studio;

· vedant7007 opened on Aug 9, 2026

[Bug] /chat/stream file upload drops user_id — logged-in session saved as orphaned guest session

Status: Open.

#320 In Rucha-Ambaliya/PrivGPT-Studio;

· vedant7007 opened on Aug 9, 2026

[Security] /chat and /chat/stream append messages to any session_id without ownership check (IDOR)

Status: Open.

#319 In Rucha-Ambaliya/PrivGPT-Studio;

· vedant7007 opened on Aug 9, 2026

[Security] Mentioned sessions read without ownership check — IDOR leaks any user's chat history

Status: Open.

#318 In Rucha-Ambaliya/PrivGPT-Studio;

· vedant7007 opened on Aug 9, 2026

FEATURE: Prevent Server-Side Request Forgery (SSRF) in Web Search Tools

Status: Open.

#317 In Rucha-Ambaliya/PrivGPT-Studio;

· Diwakar-odds opened on Aug 8, 2026

FEATURE: Streaming Responses via Server-Sent Events (SSE)

Status: Open.

#316 In Rucha-Ambaliya/PrivGPT-Studio;

· Diwakar-odds opened on Aug 8, 2026

FEATURE: Decouple LLM Engine using the Factory Pattern

Status: Open.

#315 In Rucha-Ambaliya/PrivGPT-Studio;

· Diwakar-odds opened on Aug 8, 2026

FEATURE: Support local Ollama models from the deployed web application

ECSoC26

enhancementNew feature or requestNew feature or request

Status: Open.

#291 In Rucha-Ambaliya/PrivGPT-Studio;

· Rucha-Ambaliya opened on Jul 12, 2026