ntindle Open Source Projects | Good First Issue

confirmd: _load_answered() re-parses up to CONFIRM_CONSUMED_KEEP files on every 5s poll Open

area:confirmd severity:low track:open-source

Difficulty 3/5 1-2 days Newbie friendliness 78/100

ntindle/spark-vm#214 · Opened Sep 21, 2026

confirmd: expired approvals are a silent third outcome — no terminal record an agent-side waiter can read Open

area:confirmd severity:medium track:hosted-product

Difficulty 5/5 Over a week Newbie friendliness 25/100

ntindle/spark-vm#213 · Opened Sep 21, 2026

muse-job: handle Muse auto-update prompts under running jobs Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ntindle/spark-vm#212 · Opened Sep 21, 2026

muse-job blind to dead TUI behind live tmux (model stream idle timeout) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ntindle/spark-vm#211 · 1 comment · Opened Sep 21, 2026

[arch] proxy: per-placeholder grant re-evaluation and per-placeholder audit open/close on the request hot path Open

area:proxy severity:low track:open-source

Difficulty 5/5 Over a week Newbie friendliness 45/100

ntindle/spark-vm#199 · Opened Sep 21, 2026

[arch] proxy: unrecognized registry placement shapes fail open — a typo silently swaps everywhere Open

area:proxy track:open-source

Difficulty 3/5 1-2 days Newbie friendliness 76/100

ntindle/spark-vm#197 · Opened Sep 21, 2026

confirmd: load_pending() Finding-58 reap can race _answer_locked → uncaught FileNotFoundError (500 on a legitimate answer) Open

area:confirmd severity:medium track:open-source

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

ntindle/spark-vm#195 · Opened Sep 21, 2026

confirmd: in-process atomicity state has no multi-replica story (hosted scale-out gap) Open

area:confirmd severity:medium track:hosted-product

Difficulty 5/5 Over a week Newbie friendliness 35/100

ntindle/spark-vm#194 · Opened Sep 21, 2026

confirmd: per-aid lock entries are never evicted; the "bounded by pending items" comment is false Open

area:confirmd severity:low track:open-source

Difficulty 3/5 1-2 days Newbie friendliness 72/100

ntindle/spark-vm#193 · Opened Sep 21, 2026

confirmd: consumed/ answered history grows unbounded; every 5s poll re-reads and re-parses all of it Open

area:confirmd severity:low track:open-source

Difficulty 3/5 1-2 days Newbie friendliness 75/100

ntindle/spark-vm#192 · Opened Sep 21, 2026

#47: decide stopped-state surface + file-browsing scope Open

enhancement track:hosted-product

Difficulty 5/5 Over a week Newbie friendliness 25/100

ntindle/spark-vm#180 · Opened Sep 21, 2026

#47: define desktop/terminal stream-ownership semantics Open

enhancement track:hosted-product

Difficulty 5/5 Over a week Newbie friendliness 28/100

ntindle/spark-vm#178 · 1 comment · Opened Sep 21, 2026

#47: define the idle lifecycle policy model Open

enhancement track:hosted-product

Difficulty 5/5 Over a week Newbie friendliness 35/100

ntindle/spark-vm#179 · 1 comment · Opened Sep 21, 2026

#47: name pause/resume in acceptance + define memory-preservation semantics Open

enhancement track:hosted-product

Difficulty 3/5 1-2 days Newbie friendliness 64/100

ntindle/spark-vm#177 · Opened Sep 21, 2026

Consider a GitHub tag-protection ruleset for v* (release tag immutability is convention-only) Open

track:distribution track:security

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ntindle/spark-vm#174 · 1 comment · Opened Sep 20, 2026

bdrive daemon socket: path-validation requirements for the jail bind-mount (R16 relay audit) Open

security

Difficulty 5/5 Over a week Newbie friendliness 25/100

ntindle/spark-vm#169 · Opened Sep 20, 2026

[arch] harness: provision CLI_TIMEOUT_S=6s is aggressive for a real provider round-trip Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

ntindle/spark-vm#159 · Opened Sep 20, 2026

[arch] harness: confirmd liveness accepts any HTTP response — doesn't assert it's confirmd Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ntindle/spark-vm#160 · Opened Sep 20, 2026

[arch] harness: probe's 10s wall-clock budget is invoker-enforced, not self-enforced Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ntindle/spark-vm#158 · Opened Sep 20, 2026

[arch] harness: gate fixture records only the Authorization header — placeholder leak via other channels passes the gate Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

ntindle/spark-vm#157 · Opened Sep 20, 2026

[arch] harness: provision-mode probe can pass on a baked-in/leaked credential instead of the injected placeholder Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

ntindle/spark-vm#156 · Opened Sep 20, 2026

[arch] harness: golden-image manifest is unsigned — injector trusts a self-asserted manifest Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

ntindle/spark-vm#155 · Opened Sep 20, 2026

[arch] harness: no gate-time scan enforces the never-bake-values rule Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

ntindle/spark-vm#154 · Opened Sep 20, 2026

arch: name/host/placement validation regexes are triplicated across cred CLI, cred-ui, and narrow writers Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ntindle/spark-vm#150 · Opened Sep 20, 2026

arch: `cred set` reads stdin unbounded before the 64 KiB writer cap Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

ntindle/spark-vm#149 · Opened Sep 20, 2026

arch: `cred list` silently reports empty on any store-read failure Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

ntindle/spark-vm#148 · Opened Sep 20, 2026

arch: `cred get` reports "not set" for any reader failure, not just missing Open

Difficulty 3/5 1-2 days Newbie friendliness 70/100

ntindle/spark-vm#147 · Opened Sep 20, 2026

arch: `cred register` host binding is not atomic across its 1+N writer calls Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ntindle/spark-vm#146 · Opened Sep 20, 2026

deploy.sh: step 4b (ca-bundle) cats a swapd-planted source symlink into a world-readable bundle Open

security

Difficulty 3/5 1-2 days Newbie friendliness 72/100

ntindle/spark-vm#144 · Opened Sep 20, 2026

Protect the main branch: proposed ruleset (maintainer decision) Open

area:repo track:open-source

Difficulty 5/5 Over a week Newbie friendliness 25/100

ntindle/spark-vm#138 · Opened Sep 20, 2026

H19 — provision-time credential install packet Open

track:hosted-product

Difficulty 5/5 Over a week Newbie friendliness 25/100

ntindle/spark-vm#134 · Opened Sep 20, 2026

H18 — client-visible approval pending/terminal-decision signal Open

track:hosted-product

Difficulty 5/5 Over a week Newbie friendliness 45/100

ntindle/spark-vm#133 · Opened Sep 20, 2026

H17 — browser-driver implementation first slice: bdrive action protocol + Chromium driver service Open

track:hosted-product

Difficulty 5/5 Over a week Newbie friendliness 42/100

ntindle/spark-vm#132 · Opened Sep 20, 2026

test: CRLF-only refusal case for cred-store-set-inference chomp Open

area:proxy good first issue severity:low track:open-source

Difficulty 1/5 Under an hour Newbie friendliness 88/100

ntindle/spark-vm#122 · Opened Sep 19, 2026

swap: bare-rendering scrub triples for multi-entry (dict) secrets Open

area:proxy security severity:low track:open-source

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

ntindle/spark-vm#121 · Opened Sep 19, 2026

cred-ui: NAME_RE/ENTRY_RE non-string input drops the connection instead of 400 Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

ntindle/spark-vm#118 · Opened Sep 19, 2026

cred-ui api_set: host registration is not atomic (partial state on mid-loop failure) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 52/100

ntindle/spark-vm#116 · Opened Sep 19, 2026

cred-ui.service has no systemd hardening (compare confirmd) Open

security

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

ntindle/spark-vm#115 · Opened Sep 19, 2026

cred-ui: saving a credential silently drops entry-level registry keys (e.g. the scrub opt-out) Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 62/100

ntindle/spark-vm#114 · Opened Sep 19, 2026

test_snapshot_and_rollback fails on deployed boxes (unreadable /etc/sudoers.d/swapd) Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

ntindle/spark-vm#108 · Opened Sep 19, 2026

deploy: distinguish 'sudo check errored' from 'check returned false' in rollback Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ntindle/spark-vm#107 · Opened Sep 19, 2026

docs: quarterly manual re-sweep of lychee-excluded hosts Open

good first issue

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

ntindle/spark-vm#106 · Opened Sep 19, 2026

test: no coverage for symlink-to-live-target at ABSENT path Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

ntindle/spark-vm#104 · Opened Sep 19, 2026

test: snapshot_component existence checks have no dedicated test Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

ntindle/spark-vm#105 · Opened Sep 19, 2026

deploy: empty-path ABSENT manifest line is now fail-open Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

ntindle/spark-vm#103 · Opened Sep 19, 2026

cred-registry-set 'set' silently clobbers a per-entry scrub:false opt-out Open

area:proxy security severity:low track:open-source

Difficulty 1/5 Under an hour Newbie friendliness 90/100

ntindle/spark-vm#96 · Opened Sep 19, 2026

no systemd hardening on the swap proxy services Open

area:proxy security severity:low track:open-source

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

ntindle/spark-vm#95 · Opened Sep 19, 2026

open-redirect on an allowlisted host forwards the real secret off-allowlist Open

area:proxy security severity:low track:open-source

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ntindle/spark-vm#94 · Opened Sep 19, 2026

deploy.sh rewrites ssrf.deny non-atomically against the mtime hot-reload Open

area:proxy security severity:low track:open-source

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

ntindle/spark-vm#93 · Opened Sep 19, 2026

streaming (SSE) response bodies bypass all response scrubbing Open

area:proxy security severity:medium track:open-source

Difficulty 5/5 Over a week Newbie friendliness 35/100

ntindle/spark-vm#92 · Opened Sep 19, 2026

ntindle

Get new issues in your inbox