Issues

• Bounty #36: receipt verifier trusts mutable expiry/action fields outside signature

  permission-protocol/deploy-gate#65 · Filter by author vagdotdev opened on Jul 4, 2026
  2

• Bounty #36: non-injective scope signing bytes allow receipt scope tuple rewrite

  permission-protocol/deploy-gate#64 · Filter by author alan-provable opened on Jun 29, 2026
  1

• Deploy Gate can be bypassed by opening protected-path PR as draft, then marking ready

  permission-protocol/deploy-gate#63 · Filter by author stmr opened on Jun 26, 2026
  1

• Bounty claim for #36: Deploy Gate draft PR bypass and scoped receipt signing ambiguity

  permission-protocol/deploy-gate#62 · Filter by author snkk2x-collab opened on Jun 18, 2026

• Challenge submission: offline receipt gate trusts PR-controlled public key

  permission-protocol/deploy-gate#61 · Filter by author jaxassistant55 opened on Jun 18, 2026
  1

• Bypass #36: authorization token fields are mutable outside the Ed25519 signature

  permission-protocol/deploy-gate#60 · Filter by author caydyan opened on Jun 14, 2026
  5

• MCP Guard forwards JSON-RPC batch tools/call without policy enforcement

  permission-protocol/deploy-gate#59 · Filter by author keilogic opened on Jun 10, 2026
  1

• Bypass POC for #36: algorithm confusion in local pp verify

  permission-protocol/deploy-gate#58 · Filter by author akuraposo opened on Jun 4, 2026
  1

• Bounty claim: non-member GitHub session can approve deploy request by ID via API

  permission-protocol/deploy-gate#57 · Filter by author sjj79475067-max opened on Jun 4, 2026

• Reference verifier accepts null required signed fields omitted from signature bytes

  permission-protocol/deploy-gate#54 · Filter by author oathis opened on May 31, 2026
  1

• Reference verifier accepts unsupported receiptVersion values as valid

  permission-protocol/deploy-gate#53 · Filter by author oathis opened on May 31, 2026
  1

• Reference verifier accepts non-Ed25519 signatures labeled as ed25519

  permission-protocol/deploy-gate#52 · Filter by author endscene665 opened on May 30, 2026

• Nested __proto__ request content is omitted from receipt signing bytes

  permission-protocol/deploy-gate#51 · Filter by author Mirochill opened on May 30, 2026
  1

• Verifier accepts Ed25519 signatures from remotely resolved revoked keys

  permission-protocol/deploy-gate#50 · Filter by author Mirochill opened on May 30, 2026

• Verifier accepts signed non-authorizing receipt statuses

  permission-protocol/deploy-gate#49 · Filter by author manuelsampedro1 opened on May 19, 2026
  5

• Receipt carry-forward accepts changed PR head

  permission-protocol/deploy-gate#46 · Filter by author jamilahmadzai opened on May 18, 2026

• Bypass: draft PR skip can leave Deploy Gate green after ready_for_review without receipt verification

  permission-protocol/deploy-gate#45 · Filter by author haradahinata opened on May 17, 2026

• Challenge: Bypass the Ed25519 signature verification ($200 bounty)

  permission-protocol/deploy-gate#36 · Filter by author rodchalski opened on Mar 24, 2026
  3

• Auto-approve on branch update when prior approval exists for same PR

  factoryp1
  permission-protocol/deploy-gate#22 · Filter by author rodchalski opened on Mar 18, 2026