Jonatan Männchen / EEF

Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor

Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Unsafe deserialization of decrypted terms enables node DoS in AshCloak

rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail

Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)