Zach Daniel / Ash Project

Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor

Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Unsafe deserialization of decrypted terms enables node DoS in AshCloak

rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail

Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql