codersdk

Aug 4, 2026

Changes in this version

+ const ChatGitWatchNoEligibleAgentMessage

+ const ChatModelReasoningEffortHigh

+ const ChatModelReasoningEffortLow

+ const ChatModelReasoningEffortMax

+ const ChatModelReasoningEffortMedium

+ const ChatModelReasoningEffortMinimal

+ const ChatModelReasoningEffortNone

+ const ChatModelReasoningEffortXHigh

+ const MaxAISpendLimitMicros

+ const MaxSecretsFileBytes

+ const OAuth2RedirectURICookie

+ const UserSecretEnvNameField

+ const UserSecretFilePathField

+ const UserSecretInjectionTargetRequiredDetail

+ const UserSecretNameField

+ const UserSecretValueField

+ var AllChatComputerUseProviders = []ChatComputerUseProvider

+ func ChatModelReasoningEffortValues() []string

type AIBridgeProxyConfig

+ Target serpent.String

type AIBridgeSession

+ NetworkCalls *AIBridgeSessionNetworkCallSummary

+ type AIBridgeSessionNetworkCallSummary struct

+ Blocked int64

+ Total int64

+ type AIBridgeSessionNetworkDomain struct

+ Count int64

+ Domain string

type AIBridgeSessionThreadsResponse

+ NetworkCallLogs []AgentFirewallLog

+ NetworkCalls *AIBridgeSessionNetworkCallSummary

+ NetworkDomainCount int64

+ NetworkTopDomains []AIBridgeSessionNetworkDomain

type AIBridgeThread

+ ErrorMessage *string

+ ErrorType *string

+ type AIBudgetLimit struct

+ LimitSource AIBudgetLimitSource

+ SpendLimitMicros int64

+ type AIBudgetLimitSource string

+ const AIBudgetLimitSourceGroup

+ const AIBudgetLimitSourceUserOverride

type AIBudgetPeriod

+ func NewAIBudgetPeriodFromString(s string) AIBudgetPeriod

+ func (p AIBudgetPeriod) Adjective() string

type AIProvider

+ Icon string

+ type AIProviderBedrockProtocol string

+ const AIProviderBedrockProtocolInvokeModel

+ const AIProviderBedrockProtocolMantle

type AIProviderBedrockSettings

+ ExternalID string

+ Protocol AIProviderBedrockProtocol

+ func (b AIProviderBedrockSettings) ResolvedProtocol() AIProviderBedrockProtocol

type AIProviderSummary

+ Icon string

+ type AISpendPeriodWindow struct

+ PeriodEnd time.Time

+ PeriodStart time.Time

type APIKeyScope

+ const APIKeyScopeWorkspaceBuildOrchestrationAll

+ const APIKeyScopeWorkspaceBuildOrchestrationCreate

+ const APIKeyScopeWorkspaceBuildOrchestrationDelete

+ const APIKeyScopeWorkspaceBuildOrchestrationRead

+ const APIKeyScopeWorkspaceBuildOrchestrationUpdate

type AdvisorConfig

+ ReasoningEffort *string

type Chat

+ LastReasoningEffort *string

+ Summary *string

+ type ChatComputerUseProvider string

+ const ChatComputerUseProviderAnthropic

+ const ChatComputerUseProviderOpenAI

+ func (p ChatComputerUseProvider) Valid() bool

+ type ChatCost struct

+ ChatID uuid.UUID

+ PricedMessageCount int64

+ TotalCostMicros int64

+ UnpricedMessagesHavingUsageCount int64

type ChatCostSummary

+ UnpricedMessagesHavingUsageCount int64

type ChatErrorKind

+ const ChatErrorKindContentFilter

type ChatModelAnthropicProviderOptions

+ Context1MEnabled *bool

type ChatModelCallConfig

+ ReasoningEffort *ChatModelReasoningEffortConfig

+ func (c *ChatModelCallConfig) UnmarshalStrict(data []byte) error

type ChatModelConfig

+ ReasoningEfforts []string

type ChatModelOverrideContext

+ const ChatModelOverrideContextCompaction

type ChatModelOverrideResponse

+ ReasoningEffort *string

+ type ChatModelReasoningEffortConfig struct

+ Default *string

+ Max *string

type ChatPersonalModelOverride

+ ReasoningEffort *string

type ChatProviderConfig

+ Icon string

type ChatWatchEventKind

+ const ChatWatchEventKindChatSummaryChange

type Client

+ func (c *Client) ExportOrganizationAISpend(ctx context.Context, organization uuid.UUID, opts AISpendPeriodWindow) (io.ReadCloser, error)

+ func (c *Client) GroupAISpend(ctx context.Context, group uuid.UUID) (GroupAISpend, error)

+ func (c *Client) GroupMembersAISpend(ctx context.Context, group uuid.UUID, userIDs []uuid.UUID) (GroupMembersAISpend, error)

+ func (c *Client) ImportUserSecrets(ctx context.Context, user string, req ImportUserSecretsRequest) ([]UserSecret, error)

+ func (c *Client) MCPServerOAuth2DisconnectWithResponse(ctx context.Context, id uuid.UUID) (MCPServerOAuth2DisconnectResponse, error)

+ func (c *Client) OrganizationGroupsAISpend(ctx context.Context, organization uuid.UUID, groupIDs []uuid.UUID) (OrganizationGroupsAISpend, error)

+ func (c *Client) TemplateBuilderSession(ctx context.Context, req TemplateBuilderSessionRequest) error

+ func (c *Client) UserAISpendStatus(ctx context.Context, user uuid.UUID) (UserAISpendStatus, error)

type CreateAIProviderRequest

+ Icon string

type CreateChatMessageRequest

+ ReasoningEffort *string

type CreateChatProviderConfigRequest

+ Icon string

type CreateChatRequest

+ ReasoningEffort *string

type CreateMCPServerConfigRequest

+ OAuth2RevocationURL string

type CreateUserSecretRequest

+ Enabled *bool

+ func ParseSecretsFile(format SecretsFileFormat, content string) ([]CreateUserSecretRequest, error)

+ type CreateWorkspaceBuildOnSuccessRequest struct

+ RichParameterValues []WorkspaceBuildParameter

+ TemplateVersionID uuid.UUID

+ TemplateVersionPresetID uuid.UUID

+ Transition WorkspaceTransition

type CreateWorkspaceBuildRequest

+ OnSuccess *CreateWorkspaceBuildOnSuccessRequest

type CryptoKeyFeature

+ const CryptoKeyFeatureNATSCA

type EditChatMessageRequest

+ ReasoningEffort *string

type Experiment

+ const ExperimentAIGatewaySeatExclusion

+ const ExperimentWorkspaceCapableLicensing

type ExperimentalClient

+ func (c *ExperimentalClient) CompactChat(ctx context.Context, chatID uuid.UUID) (Chat, error)

+ func (c *ExperimentalClient) GetChatCost(ctx context.Context, chatID uuid.UUID) (ChatCost, error)

+ type GroupAISpend struct

+ type GroupMemberAISpend struct

+ EffectiveGroupID *uuid.UUID

+ GroupBudget *AIBudgetLimit

+ GroupSpendMicros int64

+ UserID uuid.UUID

+ type GroupMembersAISpend struct

+ Members []GroupMemberAISpend

+ type ImportUserSecretsRequest struct

+ Content string

+ Format SecretsFileFormat

type MCPServerConfig

+ OAuth2RevocationURL string

+ type MCPServerOAuth2DisconnectResponse struct

+ TokenRevocationError string

+ TokenRevoked bool

type OIDCConfig

+ RedirectAllowedHosts serpent.StringArray

+ type OrganizationGroupAISpend struct

+ CurrentSpendMicros int64

+ GroupID uuid.UUID

+ SpendLimitMicros *int64

+ TotalSpendLimitMicros *int64

+ type OrganizationGroupsAISpend struct

+ Groups []OrganizationGroupAISpend

type RBACResource

+ const ResourceWorkspaceBuildOrchestration

+ type SecretsFileFormat string

+ const SecretsFileFormatEnv

+ const SecretsFileFormatJSON

+ const SecretsFileFormatYAML

+ type TemplateBuilderSessionEventType string

+ const TemplateBuilderSessionEventComposeCompletion

+ const TemplateBuilderSessionEventWizardEntry

+ type TemplateBuilderSessionRequest struct

+ BaseTemplateID string

+ DurationSeconds float64

+ EventType TemplateBuilderSessionEventType

+ ModuleIDs []string

+ SessionID uuid.UUID

+ Success bool

type UpdateAIProviderRequest

+ Icon *string

type UpdateChatModelOverrideRequest

+ ReasoningEffort *string

type UpdateChatProviderConfigRequest

+ Icon string

type UpdateMCPServerConfigRequest

+ OAuth2RevocationURL *string

type UpdateUserChatPersonalModelOverrideRequest

+ ReasoningEffort *string

type UpdateUserSecretRequest

+ Enabled *bool

+ type UserAIBudgetSummary struct

+ EffectiveBudget *AIBudgetLimit

+ EffectiveGroupID *uuid.UUID

+ UserID uuid.UUID

+ type UserAISpendStatus struct

+ CurrentSpendMicros int64

type UserChatProviderConfig

+ Enabled bool

+ Icon string

type UserSecret

+ Enabled bool

type ValidationError

+ func ValidateCreateUserSecretRequest(req CreateUserSecretRequest) []ValidationError

Aug 25, 2026

Changes in this version

type DeploymentValues

+ DisableWorkspaceAgentContextSync serpent.Bool

Jul 7, 2026

Changes in this version

+ const AIGatewayKeyHeader

+ const RoleOrganizationWorkspaceAccess

+ func IsAgentsUnsupportedProviderType(t AIProviderType) bool

type AIBridgeThread

+ AgentFirewallSequenceNumber *int32

+ AgentFirewallSessionID *uuid.UUID

type AIBudgetPolicy

+ func NewAIBudgetPolicyFromString(s string) AIBudgetPolicy

+ type AIGatewayKey struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ KeyPrefix string

+ LastHeartbeatAt *time.Time

+ Name string

type AIProviderBedrockSettings

+ RoleARN string

type APIKeyScope

+ const APIKeyScopeAiGatewayKeyAll

+ const APIKeyScopeAiGatewayKeyCreate

+ const APIKeyScopeAiGatewayKeyDelete

+ const APIKeyScopeAiGatewayKeyRead

+ const APIKeyScopeAiGatewayKeyUpdate

+ const APIKeyScopeBoundaryLogAll

+ const APIKeyScopeBoundaryLogCreate

+ const APIKeyScopeBoundaryLogDelete

+ const APIKeyScopeBoundaryLogRead

+ type AgentFirewallLog struct

+ Allowed bool

+ CapturedAt *time.Time

+ CreatedAt time.Time

+ Detail string

+ ID uuid.UUID

+ MatchedRule *string

+ Method string

+ Proto string

+ SequenceNumber int32

+ SessionID uuid.UUID

+ type AgentFirewallSession struct

+ ConfinedProcess string

+ ID uuid.UUID

+ OwnerID uuid.UUID

+ StartedAt time.Time

+ WorkspaceID uuid.UUID

+ type AgentFirewallSessionLogsParams struct

+ Limit *int32

+ SeqAfter *int64

+ SeqBefore *int64

+ type AgentFirewallSessionLogsResponse struct

+ Results []AgentFirewallLog

+ type AgentsUnsupportedProviderType string

+ const AgentsUnsupportedProviderTypeCopilot

type Chat

+ Context *ChatContext

+ Shared bool

+ type ChatContext struct

+ Dirty bool

+ DirtySince *time.Time

+ Error string

+ Resources []ChatContextResource

+ type ChatContextResource struct

+ Error string

+ Kind ChatContextResourceKind

+ SizeBytes int64

+ SkillDescription string

+ SkillName string

+ Source string

+ Status ChatContextResourceStatus

+ Tools []ChatContextTool

+ type ChatContextResourceKind string

+ const ChatContextResourceKindInstructionFile

+ const ChatContextResourceKindMCPConfig

+ const ChatContextResourceKindMCPServer

+ const ChatContextResourceKindSkill

+ type ChatContextResourceStatus string

+ const ChatContextResourceStatusExcluded

+ const ChatContextResourceStatusInvalid

+ const ChatContextResourceStatusOK

+ const ChatContextResourceStatusOversize

+ const ChatContextResourceStatusUnreadable

+ type ChatContextTool struct

+ Description string

+ Name string

type ChatErrorKind

+ const ChatErrorKindStreamSilenceTimeout

+ type ChatListSource string

+ const ChatListSourceCreatedByMe

+ const ChatListSourceSharedWithMe

type ChatModelAnthropicProviderOptions

+ ThinkingDisplay *string

type ChatModelsResponse

+ UnsupportedProviders []ChatUnsupportedProvider

type ChatStatus

+ const ChatStatusInterrupting

type ChatStreamEventType

+ const ChatStreamEventTypeHistoryReset

+ const ChatStreamEventTypePreviewReset

type ChatStreamMessagePart

+ GenerationAttempt int64

+ HistoryVersion int64

+ Seq int64

+ type ChatUnsupportedProvider struct

+ DisplayName string

+ Provider string

type ChatWatchEventKind

+ const ChatWatchEventKindContextDirty

type Client

+ func (c *Client) AgentFirewallSessionByID(ctx context.Context, id uuid.UUID) (AgentFirewallSession, error)

+ func (c *Client) AgentFirewallSessionLogs(ctx context.Context, sessionID uuid.UUID, ...) (AgentFirewallSessionLogsResponse, error)

+ func (c *Client) CreateAIGatewayKey(ctx context.Context, req CreateAIGatewayKeyRequest) (CreateAIGatewayKeyResponse, error)

+ func (c *Client) DeleteAIGatewayKey(ctx context.Context, id uuid.UUID) error

+ func (c *Client) DeleteUserAIBudgetOverride(ctx context.Context, user uuid.UUID) error

+ func (c *Client) ListAIGatewayKeys(ctx context.Context) ([]AIGatewayKey, error)

+ func (c *Client) TemplateBuilderBases(ctx context.Context) (TemplateBuilderBasesResponse, error)

+ func (c *Client) TemplateBuilderCompose(ctx context.Context, req TemplateBuilderComposeRequest) ([]byte, error)

+ func (c *Client) TemplateBuilderCreateTemplate(ctx context.Context, req TemplateBuilderCreateTemplateRequest) (TemplateBuilderCreateTemplateResponse, error)

+ func (c *Client) TemplateBuilderModules(ctx context.Context, base string) (TemplateBuilderModulesResponse, error)

+ func (c *Client) UpsertUserAIBudgetOverride(ctx context.Context, user uuid.UUID, req UpsertUserAIBudgetOverrideRequest) (UserAIBudgetOverride, error)

+ func (c *Client) UserAIBudgetOverride(ctx context.Context, user uuid.UUID) (UserAIBudgetOverride, error)

+ type ClusterConfig struct

+ Host serpent.String

+ type CreateAIGatewayKeyRequest struct

+ Name string

+ type CreateAIGatewayKeyResponse struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Key string

+ KeyPrefix string

+ Name string

type CreateTemplateRequest

+ TimeTilAutostopNotifyMillis *int64

type DeploymentValues

+ Cluster ClusterConfig

+ UseLegacySCIM serpent.Bool

type Experiment

+ const ExperimentAIGatewayCostControl

+ const ExperimentChatAdvisor

+ const ExperimentChatVirtualDesktop

+ const ExperimentMinimumImplicitMember

+ const ExperimentNATSPubsub

type ExperimentalClient

+ func (c *ExperimentalClient) ReconcileInvalidChatState(ctx context.Context, chatID uuid.UUID) (Chat, error)

+ func (c *ExperimentalClient) RefreshChatContext(ctx context.Context, chatID uuid.UUID) (Chat, error)

type ListChatsOptions

+ Source ChatListSource

type Organization

+ DefaultOrgMemberRoles []string

type RBACResource

+ const ResourceAIGatewayKey

+ const ResourceBoundaryLog

type ResourceType

+ const ResourceTypeAIGatewayKey

+ const ResourceTypeUserAIBudgetOverride

type RetentionConfig

+ BoundaryLogs serpent.Duration

type Template

+ TimeTilAutostopNotifyMillis int64

+ type TemplateBuilderBase struct

+ Description string

+ ID string

+ Icon string

+ Name string

+ OS string

+ Prerequisites string

+ Variables []TemplateBuilderModuleVariable

+ type TemplateBuilderBasesResponse struct

+ Bases []TemplateBuilderBase

+ type TemplateBuilderComposeModule struct

+ ID string

+ Variables map[string]string

+ type TemplateBuilderComposeRequest struct

+ BaseTemplateID string

+ BaseVariableValues map[string]string

+ Modules []TemplateBuilderComposeModule

+ type TemplateBuilderCreateTemplateRequest struct

+ BaseTemplateID string

+ BaseVariableValues map[string]string

+ Description string

+ DisplayName string

+ Icon string

+ Modules []TemplateBuilderComposeModule

+ Name string

+ OrganizationID uuid.UUID

+ ProvisionerTags map[string]string

+ type TemplateBuilderCreateTemplateResponse struct

+ Template Template

+ type TemplateBuilderModule struct

+ Category string

+ CompatibleOS []string

+ ConflictsWith []string

+ Description string

+ DisplayName string

+ ID string

+ Icon string

+ Variables []TemplateBuilderModuleVariable

+ Version string

+ type TemplateBuilderModuleVariable struct

+ Default json.RawMessage

+ Description string

+ Name string

+ Required bool

+ Sensitive bool

+ Type TemplateBuilderVariableType

+ type TemplateBuilderModulesResponse struct

+ Modules []TemplateBuilderModule

+ type TemplateBuilderVariableType string

+ const TemplateBuilderVariableTypeBool

+ const TemplateBuilderVariableTypeNumber

+ const TemplateBuilderVariableTypeString

type UpdateOrganizationRequest

+ DefaultOrgMemberRoles *[]string

type UpdateTemplateMeta

+ TimeTilAutostopNotifyMillis *int64

type UpdateUserProfileRequest

+ AvatarURL string

+ type UpsertUserAIBudgetOverrideRequest struct

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ type UserAIBudgetOverride struct

+ CreatedAt time.Time

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ UpdatedAt time.Time

+ UserID uuid.UUID

type WorkspaceFilter

+ Organization string

Jun 17, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 11, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 8, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 2, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const AIProviderBedrockSettingsVersion

+ const AIProviderSettingsTypeBedrock

+ const AnthropicInlineImageCapBytes

+ const DefaultChatDebugRetentionDays

+ const MaxChatFileSizeBytes

+ const MaxUserSecretEnvNameLength

+ const MaxUserSecretValueBytes

+ const MaxUserSecretsPerUserCount

+ const MaxUserSecretsTotalValueBytes

+ const PrebuildsSystemUserID

+ var AIBudgetPeriods = []string

+ var AIBudgetPolicies = []string

+ var AIProviderNameRegex = regexp.MustCompile(`^[a-z0-9]+(-[a-z0-9]+)*$`)

+ var AllChatAttachmentMediaTypes = []ChatAttachmentMediaType

+ var AllChatErrorKinds = []ChatErrorKind

+ var ValidAgentChatSendShortcuts = []AgentChatSendShortcut

+ var ValidAgentDisplayModes = []AgentDisplayMode

+ func IsBedrockConfigured(baseURL string, b AIProviderBedrockSettings) bool

+ func JobIsInsufficientQuotaErrorCode(code JobErrorCode) bool

+ func SlogDisconnectDetail(detail string) slog.Field

+ func UserSecretNameValid(s string) error

type AIBridgeConfig

+ APIDumpDir serpent.String

+ BudgetPeriod string

+ BudgetPolicy string

type AIBridgeListInterceptionsFilter

+ ProviderName string

type AIBridgeListSessionsFilter

+ ProviderName string

type AIBridgeProxyConfig

+ APIDumpDir serpent.String

+ type AIBudgetPeriod string

+ const AIBudgetPeriodMonth

+ type AIBudgetPolicy string

+ const AIBudgetPolicyHighest

+ type AIProvider struct

+ APIKeys []AIProviderKey

+ BaseURL string

+ CreatedAt time.Time

+ DisplayName string

+ Enabled bool

+ ID uuid.UUID

+ Name string

+ Settings AIProviderSettings

+ Type AIProviderType

+ UpdatedAt time.Time

+ type AIProviderBedrockSettings struct

+ AccessKey *string

+ AccessKeySecret *string

+ Model string

+ Region string

+ SmallFastModel string

+ func NewAIProviderBedrockSettings(region, accessKey, accessKeySecret, model, smallFastModel string) AIProviderBedrockSettings

+ func (b AIProviderBedrockSettings) IsConfigured() bool

type AIProviderConfig

+ BedrockAccessKeySecrets []string

+ BedrockAccessKeys []string

+ BedrockBaseURL string

+ BedrockModel string

+ BedrockRegion string

+ BedrockSmallFastModel string

+ Keys []string

+ Name string

+ type AIProviderKey struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Masked string

+ type AIProviderKeyMutation struct

+ APIKey *string

+ ID *uuid.UUID

+ type AIProviderSettings struct

+ Bedrock *AIProviderBedrockSettings

+ func (s *AIProviderSettings) UnmarshalJSON(data []byte) error

+ func (s AIProviderSettings) IsZero() bool

+ func (s AIProviderSettings) MarshalJSON() ([]byte, error)

+ type AIProviderSummary struct

+ Deleted bool

+ DisplayName string

+ Enabled bool

+ ID uuid.UUID

+ Name string

+ Type AIProviderType

+ type AIProviderType string

+ const AIProviderTypeAnthropic

+ const AIProviderTypeAzure

+ const AIProviderTypeBedrock

+ const AIProviderTypeCopilot

+ const AIProviderTypeGoogle

+ const AIProviderTypeOpenAI

+ const AIProviderTypeOpenAICompat

+ const AIProviderTypeOpenrouter

+ const AIProviderTypeVercel

type APIKeyScope

+ const APIKeyScopeAiModelPriceAll

+ const APIKeyScopeAiModelPriceRead

+ const APIKeyScopeAiModelPriceUpdate

+ const APIKeyScopeAiProviderAll

+ const APIKeyScopeAiProviderCreate

+ const APIKeyScopeAiProviderDelete

+ const APIKeyScopeAiProviderRead

+ const APIKeyScopeAiProviderUpdate

+ const APIKeyScopeChatShare

+ const APIKeyScopeUserSkillAll

+ const APIKeyScopeUserSkillCreate

+ const APIKeyScopeUserSkillDelete

+ const APIKeyScopeUserSkillRead

+ const APIKeyScopeUserSkillUpdate

+ type AdvisorConfig struct

+ Enabled bool

+ MaxOutputTokens int64

+ MaxUsesPerRun int

+ ModelConfigID uuid.UUID

+ type AgentChatSendShortcut string

+ const AgentChatSendShortcutEnter

+ const AgentChatSendShortcutModifierEnter

+ type AgentDisplayMode string

+ const AgentDisplayModeAlwaysCollapsed

+ const AgentDisplayModeAlwaysExpanded

+ const AgentDisplayModeAuto

type Chat

+ LastTurnSummary *string

+ OwnerName string

+ OwnerUsername string

+ type ChatACL struct

+ Groups []ChatGroup

+ Users []ChatUser

+ type ChatAttachmentMediaType string

+ const ChatAttachmentMediaTypeApplicationJSON

+ const ChatAttachmentMediaTypeApplicationPDF

+ const ChatAttachmentMediaTypeImageGIF

+ const ChatAttachmentMediaTypeImageJPEG

+ const ChatAttachmentMediaTypeImagePNG

+ const ChatAttachmentMediaTypeImageWEBP

+ const ChatAttachmentMediaTypeTextCSV

+ const ChatAttachmentMediaTypeTextMarkdown

+ const ChatAttachmentMediaTypeTextPlain

+ type ChatComputerUseProviderResponse struct

+ Provider string

type ChatConfig

+ AIGatewayRoutingEnabled serpent.Bool

+ type ChatDebugRetentionDaysResponse struct

+ DebugRetentionDays int32

+ type ChatError struct

+ Detail string

+ Kind ChatErrorKind

+ Message string

+ Provider string

+ Retryable bool

+ StatusCode int

+ type ChatErrorKind string

+ const ChatErrorKindAuth

+ const ChatErrorKindConfig

+ const ChatErrorKindGeneric

+ const ChatErrorKindMissingKey

+ const ChatErrorKindOverloaded

+ const ChatErrorKindProviderDisabled

+ const ChatErrorKindRateLimit

+ const ChatErrorKindStartupTimeout

+ const ChatErrorKindTimeout

+ const ChatErrorKindUsageLimit

+ type ChatGroup struct

+ Role ChatRole

type ChatMessagePart

+ CompletedAt *time.Time

+ ParsedCommands [][]string

+ ResultReset bool

type ChatModelConfig

+ AIProviderID *uuid.UUID

+ type ChatModelOverrideContext string

+ const ChatModelOverrideContextExplore

+ const ChatModelOverrideContextGeneral

+ const ChatModelOverrideContextTitleGeneration

+ func AllChatModelOverrideContexts() []ChatModelOverrideContext

+ func (c ChatModelOverrideContext) Valid() bool

+ type ChatModelOverrideResponse struct

+ Context ChatModelOverrideContext

+ IsMalformed bool

+ ModelConfigID string

+ type ChatPersonalModelOverride struct

+ Context ChatPersonalModelOverrideContext

+ IsMalformed bool

+ IsSet bool

+ Mode ChatPersonalModelOverrideMode

+ ModelConfigID string

+ type ChatPersonalModelOverrideContext string

+ const ChatPersonalModelOverrideContextExplore

+ const ChatPersonalModelOverrideContextGeneral

+ const ChatPersonalModelOverrideContextRoot

+ type ChatPersonalModelOverrideDeploymentDefaults struct

+ Explore ChatModelOverrideResponse

+ General ChatModelOverrideResponse

+ type ChatPersonalModelOverrideMode string

+ const ChatPersonalModelOverrideModeChatDefault

+ const ChatPersonalModelOverrideModeDeploymentDefault

+ const ChatPersonalModelOverrideModeModel

+ type ChatPersonalModelOverridesAdminSettings struct

+ AllowUsers bool

+ type ChatPrompt struct

+ ID int64

+ Text string

+ type ChatPromptsOptions struct

+ Limit int

+ type ChatPromptsResponse struct

+ Prompts []ChatPrompt

+ type ChatRole string

+ const ChatRoleDeleted

+ const ChatRoleRead

+ type ChatUser struct

+ Role ChatRole

type ChatWatchEventKind

+ const ChatWatchEventKindSummaryChange

type Client

+ func (c *Client) AIProvider(ctx context.Context, idOrName string) (AIProvider, error)

+ func (c *Client) AIProviders(ctx context.Context) ([]AIProvider, error)

+ func (c *Client) CreateAIProvider(ctx context.Context, req CreateAIProviderRequest) (AIProvider, error)

+ func (c *Client) DeleteAIProvider(ctx context.Context, idOrName string) error

+ func (c *Client) DeleteGroupAIBudget(ctx context.Context, group uuid.UUID) error

+ func (c *Client) GroupAIBudget(ctx context.Context, group uuid.UUID) (GroupAIBudget, error)

+ func (c *Client) UpdateAIProvider(ctx context.Context, idOrName string, req UpdateAIProviderRequest) (AIProvider, error)

+ func (c *Client) UpsertGroupAIBudget(ctx context.Context, group uuid.UUID, req UpsertGroupAIBudgetRequest) (GroupAIBudget, error)

+ type ConnectionDirection string

+ const ConnectionDirectionAgentToClient

+ const ConnectionDirectionClientToServer

+ const ConnectionDirectionServerToAgent

+ func (d ConnectionDirection) SlogField() slog.Field

+ type ConnectionMethod string

+ const ConnectionMethodDERP

+ const ConnectionMethodDirect

+ const ConnectionMethodUnknown

+ func (m ConnectionMethod) SlogField() slog.Field

+ func (m ConnectionMethod) Valid() bool

+ type CreateAIProviderRequest struct

+ APIKeys []string

+ BaseURL string

+ DisplayName string

+ Enabled bool

+ Name string

+ Settings AIProviderSettings

+ Type AIProviderType

+ func (req CreateAIProviderRequest) Validate() []ValidationError

type CreateChatModelConfigRequest

+ AIProviderID *uuid.UUID

type CreateMCPServerConfigRequest

+ ForwardCoderHeaders bool

+ type CreateUserAIProviderKeyRequest struct

+ APIKey string

type CreateUserRequestWithOrgs

+ Roles []string

+ type CreateUserSkillRequest struct

+ Content string

type DeploymentValues

+ DisableChatSharing serpent.Bool

+ TemplateBuilder TemplateBuilderConfig

+ type DisconnectInitiator string

+ const DisconnectInitiatorAgent

+ const DisconnectInitiatorClient

+ const DisconnectInitiatorNetwork

+ const DisconnectInitiatorServer

+ const DisconnectInitiatorUnknown

+ func (i DisconnectInitiator) SlogField() slog.Field

+ func (i DisconnectInitiator) Valid() bool

+ type DisconnectReason string

+ const DisconnectReasonClientClosed

+ const DisconnectReasonControlPlaneLost

+ const DisconnectReasonGraceful

+ const DisconnectReasonNetworkError

+ const DisconnectReasonProtocolError

+ const DisconnectReasonServerShutdown

+ const DisconnectReasonUnknown

+ const DisconnectReasonWorkspaceStopped

+ func (r DisconnectReason) Expected() bool

+ func (r DisconnectReason) SlogExpectedField() slog.Field

+ func (r DisconnectReason) SlogField() slog.Field

+ func (r DisconnectReason) Valid() bool

type EditChatMessageRequest

+ ModelConfigID *uuid.UUID

type ExperimentalClient

+ func (c *ExperimentalClient) CreateUserSkill(ctx context.Context, user string, req CreateUserSkillRequest) (UserSkill, error)

+ func (c *ExperimentalClient) DeleteUserAIProviderKey(ctx context.Context, user string, providerID uuid.UUID) error

+ func (c *ExperimentalClient) DeleteUserSkill(ctx context.Context, user string, name string) error

+ func (c *ExperimentalClient) GetChatACL(ctx context.Context, chatID uuid.UUID) (ChatACL, error)

+ func (c *ExperimentalClient) GetChatAdvisorConfig(ctx context.Context) (AdvisorConfig, error)

+ func (c *ExperimentalClient) GetChatComputerUseProvider(ctx context.Context) (ChatComputerUseProviderResponse, error)

+ func (c *ExperimentalClient) GetChatDebugRetentionDays(ctx context.Context) (ChatDebugRetentionDaysResponse, error)

+ func (c *ExperimentalClient) GetChatModelOverride(ctx context.Context, override ChatModelOverrideContext) (ChatModelOverrideResponse, error)

+ func (c *ExperimentalClient) GetChatPersonalModelOverridesAdminSettings(ctx context.Context) (ChatPersonalModelOverridesAdminSettings, error)

+ func (c *ExperimentalClient) GetChatPrompts(ctx context.Context, chatID uuid.UUID, opts *ChatPromptsOptions) (ChatPromptsResponse, error)

+ func (c *ExperimentalClient) GetUserChatPersonalModelOverrides(ctx context.Context) (UserChatPersonalModelOverridesResponse, error)

+ func (c *ExperimentalClient) ListUserAIProviderKeyConfigs(ctx context.Context, user string) ([]UserAIProviderKeyConfig, error)

+ func (c *ExperimentalClient) UpdateChatACL(ctx context.Context, chatID uuid.UUID, req UpdateChatACL) error

+ func (c *ExperimentalClient) UpdateChatAdvisorConfig(ctx context.Context, req UpdateAdvisorConfigRequest) error

+ func (c *ExperimentalClient) UpdateChatComputerUseProvider(ctx context.Context, req UpdateChatComputerUseProviderRequest) error

+ func (c *ExperimentalClient) UpdateChatDebugRetentionDays(ctx context.Context, req UpdateChatDebugRetentionDaysRequest) error

+ func (c *ExperimentalClient) UpdateChatModelOverride(ctx context.Context, override ChatModelOverrideContext, ...) error

+ func (c *ExperimentalClient) UpdateChatPersonalModelOverridesAdminSettings(ctx context.Context, req UpdateChatPersonalModelOverridesAdminSettingsRequest) error

+ func (c *ExperimentalClient) UpdateUserChatPersonalModelOverride(ctx context.Context, override ChatPersonalModelOverrideContext, ...) error

+ func (c *ExperimentalClient) UpdateUserSkill(ctx context.Context, user string, name string, req UpdateUserSkillRequest) (UserSkill, error)

+ func (c *ExperimentalClient) UpsertUserAIProviderKey(ctx context.Context, user string, providerID uuid.UUID, ...) (UserAIProviderKeyConfig, error)

+ func (c *ExperimentalClient) UserSkillByName(ctx context.Context, user string, name string) (UserSkill, error)

+ func (c *ExperimentalClient) UserSkills(ctx context.Context, user string) ([]UserSkillMetadata, error)

+ type GroupAIBudget struct

+ CreatedAt time.Time

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ UpdatedAt time.Time

type JobErrorCode

+ const InsufficientQuota

type MCPServerConfig

+ ForwardCoderHeaders bool

type RBACResource

+ const ResourceAIProvider

+ const ResourceAiModelPrice

+ const ResourceUserSkill

type ResourceType

+ const ResourceTypeAIProvider

+ const ResourceTypeAIProviderKey

+ const ResourceTypeGroupAIBudget

+ const ResourceTypeUserSkill

+ type TemplateBuilderConfig struct

+ Disabled serpent.Bool

+ RegistryURL serpent.String

+ type ThemeMode string

+ const ThemeModeSingle

+ const ThemeModeSync

+ const ThemeModeUnset

+ type UpdateAIProviderRequest struct

+ APIKeys *[]AIProviderKeyMutation

+ BaseURL *string

+ DisplayName *string

+ Enabled *bool

+ Settings *AIProviderSettings

+ func (req UpdateAIProviderRequest) IsEmpty() bool

+ func (req UpdateAIProviderRequest) Validate() []ValidationError

+ type UpdateAdvisorConfigRequest = AdvisorConfig

+ type UpdateChatACL struct

+ GroupRoles map[string]ChatRole

+ UserRoles map[string]ChatRole

+ type UpdateChatComputerUseProviderRequest struct

+ Provider string

+ type UpdateChatDebugRetentionDaysRequest struct

+ DebugRetentionDays int32

type UpdateChatModelConfigRequest

+ AIProviderID *uuid.UUID

+ type UpdateChatModelOverrideRequest struct

+ ModelConfigID string

+ type UpdateChatPersonalModelOverridesAdminSettingsRequest struct

+ AllowUsers bool

type UpdateMCPServerConfigRequest

+ ForwardCoderHeaders *bool

type UpdateUserAppearanceSettingsRequest

+ ThemeDark string

+ ThemeLight string

+ ThemeMode ThemeMode

+ type UpdateUserChatPersonalModelOverrideRequest struct

+ Mode ChatPersonalModelOverrideMode

+ ModelConfigID string

type UpdateUserPreferenceSettingsRequest

+ AgentChatSendShortcut AgentChatSendShortcut

+ CodeDiffDisplayMode AgentDisplayMode

+ ShellToolDisplayMode AgentDisplayMode

+ type UpdateUserSkillRequest struct

+ Content string

+ type UpsertGroupAIBudgetRequest struct

+ SpendLimitMicros int64

+ type UserAIProviderKeyConfig struct

+ BYOKEnabled bool

+ HasProviderAPIKey bool

+ HasUserAPIKey bool

+ Provider AIProviderSummary

type UserAppearanceSettings

+ ThemeDark string

+ ThemeLight string

+ ThemeMode ThemeMode

+ type UserChatPersonalModelOverridesResponse struct

+ DeploymentDefaults ChatPersonalModelOverrideDeploymentDefaults

+ Enabled bool

+ Explore ChatPersonalModelOverride

+ General ChatPersonalModelOverride

+ Root ChatPersonalModelOverride

type UserChatProviderConfig

+ BYOKEnabled bool

type UserPreferenceSettings

+ AgentChatSendShortcut AgentChatSendShortcut

+ CodeDiffDisplayMode AgentDisplayMode

+ ShellToolDisplayMode AgentDisplayMode

+ type UserSkill struct

+ Content string

+ type UserSkillMetadata struct

+ CreatedAt time.Time

+ Description string

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

type WorkspaceAgentScript

+ ExitCode *int32

+ Status *WorkspaceAgentScriptStatus

+ type WorkspaceAgentScriptStatus string

+ const WorkspaceAgentScriptStatusExitFailure

+ const WorkspaceAgentScriptStatusOK

+ const WorkspaceAgentScriptStatusPipesLeftOpen

+ const WorkspaceAgentScriptStatusTimedOut

Jun 17, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 11, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 8, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 23, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 19, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 7, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 6, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 5, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const ChatGitWatchAgentStatePrefix

+ const ChatGitWatchNoWorkspaceMessage

+ const ChatGitWatchWorkspaceNoAgentsMessage

+ const ChatGitWatchWorkspaceNotFoundMessage

+ const DefaultChatAutoArchiveDays

+ const MaxSecretValueSize

+ var AllChatDebugRunKinds = []ChatDebugRunKind

+ var AllChatDebugStatuses = []ChatDebugStatus

+ var AllChatDebugStepOperations = []ChatDebugStepOperation

+ var ErrNoPreviousVersion = xerrors.New("no previous template version")

+ var ValidThinkingDisplayModes = []ThinkingDisplayMode

+ func ChatGitWatchAgentStateMessage(actual WorkspaceAgentStatus) string

+ func IsChatGitWatchFallbackMessage(msg string) bool

+ func SplitWorkspaceIdentifier(identifier string) (owner, name string, err error)

+ func UserSecretEnvNameValid(s string) error

+ func UserSecretFilePathValid(s string) error

+ func UserSecretValueValid(value string) error

+ func ValidateRedirectURIScheme(u *url.URL) error

type AIBridgeConfig

+ AllowBYOK serpent.Bool

+ LegacyAnthropic AIBridgeAnthropicConfig

+ LegacyBedrock AIBridgeBedrockConfig

+ LegacyOpenAI AIBridgeOpenAIConfig

+ Providers []AIBridgeProviderConfig

+ type AIBridgeProviderConfig struct

+ BaseURL string

+ BedrockAccessKey string

+ BedrockAccessKeySecret string

+ BedrockBaseURL string

+ BedrockModel string

+ BedrockRegion string

+ BedrockSmallFastModel string

+ Key string

+ Name string

+ Type string

type AIBridgeSession

+ LastActiveAt time.Time

type AIBridgeThread

+ CredentialHint string

+ CredentialKind string

type APIKeyScope

+ const APIKeyScopeAiSeatAll

+ const APIKeyScopeAiSeatCreate

+ const APIKeyScopeAiSeatRead

type Chat

+ Children []Chat

+ ClientType ChatClientType

+ OrganizationID uuid.UUID

+ PlanMode ChatPlanMode

+ type ChatAgentModelOverrideContext string

+ const ChatAgentModelOverrideContextExplore

+ const ChatAgentModelOverrideContextGeneral

+ func AllChatAgentModelOverrideContexts() []ChatAgentModelOverrideContext

+ func (c ChatAgentModelOverrideContext) Valid() bool

+ type ChatAgentModelOverrideResponse struct

+ Context ChatAgentModelOverrideContext

+ IsMalformed bool

+ ModelConfigID string

+ type ChatAutoArchiveDaysResponse struct

+ AutoArchiveDays int32

+ type ChatClientType string

+ const ChatClientTypeAPI

+ const ChatClientTypeUI

type ChatConfig

+ DebugLoggingEnabled serpent.Bool

+ type ChatDebugLoggingAdminSettings struct

+ AllowUsers bool

+ ForcedByDeployment bool

+ type ChatDebugRun struct

+ ChatID uuid.UUID

+ FinishedAt *time.Time

+ HistoryTipMessageID *int64

+ ID uuid.UUID

+ Kind ChatDebugRunKind

+ Model *string

+ ModelConfigID *uuid.UUID

+ ParentChatID *uuid.UUID

+ Provider *string

+ RootChatID *uuid.UUID

+ StartedAt time.Time

+ Status ChatDebugStatus

+ Steps []ChatDebugStep

+ Summary map[string]any

+ TriggerMessageID *int64

+ UpdatedAt time.Time

+ type ChatDebugRunKind string

+ const ChatDebugRunKindChatTurn

+ const ChatDebugRunKindCompaction

+ const ChatDebugRunKindQuickgen

+ const ChatDebugRunKindTitleGeneration

+ type ChatDebugRunSummary struct

+ ChatID uuid.UUID

+ FinishedAt *time.Time

+ ID uuid.UUID

+ Kind ChatDebugRunKind

+ Model *string

+ Provider *string

+ StartedAt time.Time

+ Status ChatDebugStatus

+ Summary map[string]any

+ UpdatedAt time.Time

+ type ChatDebugStatus string

+ const ChatDebugStatusCompleted

+ const ChatDebugStatusError

+ const ChatDebugStatusInProgress

+ const ChatDebugStatusInterrupted

+ func ChatDebugTerminalStatuses() []ChatDebugStatus

+ type ChatDebugStep struct

+ AssistantMessageID *int64

+ Attempts []map[string]any

+ ChatID uuid.UUID

+ Error map[string]any

+ FinishedAt *time.Time

+ HistoryTipMessageID *int64

+ ID uuid.UUID

+ Metadata map[string]any

+ NormalizedRequest map[string]any

+ NormalizedResponse map[string]any

+ Operation ChatDebugStepOperation

+ RunID uuid.UUID

+ StartedAt time.Time

+ Status ChatDebugStatus

+ StepNumber int32

+ UpdatedAt time.Time

+ Usage map[string]any

+ type ChatDebugStepOperation string

+ const ChatDebugStepOperationGenerate

+ const ChatDebugStepOperationStream

type ChatMessagePart

+ CreatedAt *time.Time

+ Name string

type ChatMessagesPaginationOptions

+ AfterID int64

+ type ChatPlanMode string

+ const ChatPlanModePlan

+ type ChatPlanModeInstructionsResponse struct

+ PlanModeInstructions string

type ChatQueuedMessage

+ ModelConfigID *uuid.UUID

+ type ChatRetentionDaysResponse struct

+ RetentionDays int32

type ChatStatus

+ const ChatStatusRequiresAction

+ type ChatStreamActionRequired struct

+ ToolCalls []ChatStreamToolCall

type ChatStreamError

+ Detail string

type ChatStreamEvent

+ ActionRequired *ChatStreamActionRequired

type ChatStreamEventType

+ const ChatStreamEventTypeActionRequired

+ type ChatStreamToolCall struct

+ Args string

+ ToolCallID string

+ ToolName string

+ type ChatWatchEvent struct

+ Chat Chat

+ Kind ChatWatchEventKind

+ ToolCalls []ChatStreamToolCall

+ type ChatWatchEventKind string

+ const ChatWatchEventKindActionRequired

+ const ChatWatchEventKindCreated

+ const ChatWatchEventKindDeleted

+ const ChatWatchEventKindDiffStatusChange

+ const ChatWatchEventKindStatusChange

+ const ChatWatchEventKindTitleChange

type Client

+ func (c *Client) CreateUserSecret(ctx context.Context, user string, req CreateUserSecretRequest) (UserSecret, error)

+ func (c *Client) DERPTLSConfig() *tls.Config

+ func (c *Client) DeleteUserSecret(ctx context.Context, user string, name string) error

+ func (c *Client) ResolveWorkspace(ctx context.Context, identifier string) (Workspace, error)

+ func (c *Client) UpdateUserSecret(ctx context.Context, user string, name string, req UpdateUserSecretRequest) (UserSecret, error)

+ func (c *Client) UserSecretByName(ctx context.Context, user string, name string) (UserSecret, error)

+ func (c *Client) UserSecrets(ctx context.Context, user string) ([]UserSecret, error)

type ClientOption

+ func WithDERPTLSConfig(cfg *tls.Config) ClientOption

type CreateChatMessageRequest

+ PlanMode *ChatPlanMode

type CreateChatRequest

+ ClientType ChatClientType

+ OrganizationID uuid.UUID

+ PlanMode ChatPlanMode

+ UnsafeDynamicTools []DynamicTool

type CreateMCPServerConfigRequest

+ AllowInPlanMode bool

+ type CreateUserSecretRequest struct

+ Description string

+ EnvName string

+ FilePath string

+ Name string

+ Value string

+ type DynamicTool struct

+ Description string

+ Handler func(ctx context.Context, call DynamicToolCall) (DynamicToolResponse, error)

+ InputSchema json.RawMessage

+ Name string

+ func NewDynamicTool[T any](name, description string, ...) DynamicTool

+ type DynamicToolCall struct

+ Args string

+ ToolCallID string

+ ToolName string

+ type DynamicToolResponse struct

+ Content string

+ IsError bool

type ExperimentalClient

+ func (c *ExperimentalClient) GetChatAgentModelOverride(ctx context.Context, override ChatAgentModelOverrideContext) (ChatAgentModelOverrideResponse, error)

+ func (c *ExperimentalClient) GetChatAutoArchiveDays(ctx context.Context) (ChatAutoArchiveDaysResponse, error)

+ func (c *ExperimentalClient) GetChatDebugLogging(ctx context.Context) (ChatDebugLoggingAdminSettings, error)

+ func (c *ExperimentalClient) GetChatDebugRun(ctx context.Context, chatID uuid.UUID, runID uuid.UUID) (ChatDebugRun, error)

+ func (c *ExperimentalClient) GetChatDebugRuns(ctx context.Context, chatID uuid.UUID) ([]ChatDebugRunSummary, error)

+ func (c *ExperimentalClient) GetChatPlanModeInstructions(ctx context.Context) (ChatPlanModeInstructionsResponse, error)

+ func (c *ExperimentalClient) GetChatRetentionDays(ctx context.Context) (ChatRetentionDaysResponse, error)

+ func (c *ExperimentalClient) GetUserChatDebugLogging(ctx context.Context) (UserChatDebugLoggingSettings, error)

+ func (c *ExperimentalClient) ProposeChatTitle(ctx context.Context, chatID uuid.UUID) (ProposeChatTitleResponse, error)

+ func (c *ExperimentalClient) SubmitToolResults(ctx context.Context, chatID uuid.UUID, req SubmitToolResultsRequest) error

+ func (c *ExperimentalClient) UpdateChatAgentModelOverride(ctx context.Context, override ChatAgentModelOverrideContext, ...) error

+ func (c *ExperimentalClient) UpdateChatAutoArchiveDays(ctx context.Context, req UpdateChatAutoArchiveDaysRequest) error

+ func (c *ExperimentalClient) UpdateChatDebugLogging(ctx context.Context, req UpdateChatDebugLoggingAllowUsersRequest) error

+ func (c *ExperimentalClient) UpdateChatPlanModeInstructions(ctx context.Context, req UpdateChatPlanModeInstructionsRequest) error

+ func (c *ExperimentalClient) UpdateChatRetentionDays(ctx context.Context, req UpdateChatRetentionDaysRequest) error

+ func (c *ExperimentalClient) UpdateUserChatDebugLogging(ctx context.Context, req UpdateUserChatDebugLoggingRequest) error

+ func (c *ExperimentalClient) WatchChats(ctx context.Context) (<-chan ChatWatchEvent, io.Closer, error)

type MCPServerConfig

+ AllowInPlanMode bool

type PRInsightsResponse

+ PullRequests []PRInsightsPullRequest

+ type ProposeChatTitleResponse struct

+ Title string

type ProvisionerJobMetadata

+ WorkspaceBuildTransition WorkspaceTransition

type RBACResource

+ const ResourceAiSeat

type ResourceType

+ const ResourceTypeChat

+ const ResourceTypeUserSecret

+ type SubmitToolResultsRequest struct

+ Results []ToolResult

+ type ThinkingDisplayMode string

+ const ThinkingDisplayModeAlwaysCollapsed

+ const ThinkingDisplayModeAlwaysExpanded

+ const ThinkingDisplayModeAuto

+ const ThinkingDisplayModePreview

+ type ToolResult struct

+ IsError bool

+ Output json.RawMessage

+ ToolCallID string

+ type UpdateChatAgentModelOverrideRequest struct

+ ModelConfigID string

+ type UpdateChatAutoArchiveDaysRequest struct

+ AutoArchiveDays int32

+ type UpdateChatDebugLoggingAllowUsersRequest struct

+ AllowUsers bool

+ type UpdateChatPlanModeInstructionsRequest struct

+ PlanModeInstructions string

type UpdateChatRequest

+ PlanMode *ChatPlanMode

+ WorkspaceID *uuid.UUID

+ type UpdateChatRetentionDaysRequest struct

+ RetentionDays int32

type UpdateMCPServerConfigRequest

+ AllowInPlanMode *bool

+ type UpdateUserChatDebugLoggingRequest struct

+ DebugLoggingEnabled bool

type UpdateUserPreferenceSettingsRequest

+ ThinkingDisplayMode ThinkingDisplayMode

+ type UpdateUserSecretRequest struct

+ Description *string

+ EnvName *string

+ FilePath *string

+ Value *string

+ type UserChatDebugLoggingSettings struct

+ DebugLoggingEnabled bool

+ ForcedByDeployment bool

+ UserToggleAllowed bool

type UserPreferenceSettings

+ ThinkingDisplayMode ThinkingDisplayMode

+ type UserSecret struct

+ CreatedAt time.Time

+ Description string

+ EnvName string

+ FilePath string

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

Apr 22, 2026 GO-2026-5169 +1 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

Apr 15, 2026 GO-2026-5169 +1 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

Apr 8, 2026 GO-2026-5169 +1 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

Apr 1, 2026 GO-2026-5169 +1 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

Jun 30, 2026

Changes in this version

type OIDCConfig

+ EmailFallback serpent.Bool

Jun 17, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 11, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 8, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 30, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 19, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 28, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 14, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const ChatCompactionThresholdKeyPrefix

+ const DebugProfileDurationMax

+ const DefaultChatWorkspaceTTL

+ const LicenseAIGovernance90PercentWarningText

+ const LicenseAIGovernanceOverLimitWarningText

+ const MaxChatFileIDs

+ const RoleAgentsAccess

+ func CompactionThresholdKey(modelConfigID uuid.UUID) string

+ func ParseChatWorkspaceTTL(s string) (time.Duration, error)

+ type AIBridgeAgenticAction struct

+ Model string

+ Thinking []AIBridgeModelThought

+ TokenUsage AIBridgeSessionThreadsTokenUsage

+ ToolCalls []AIBridgeToolCall

type AIBridgeInterception

+ ProviderName string

+ type AIBridgeListSessionsFilter struct

+ AfterSessionID string

+ Client string

+ FilterQuery string

+ Initiator string

+ Model string

+ Pagination Pagination

+ Provider string

+ SessionID string

+ StartedAfter time.Time

+ StartedBefore time.Time

+ type AIBridgeListSessionsResponse struct

+ Count int64

+ Sessions []AIBridgeSession

+ type AIBridgeModelThought struct

+ Text string

type AIBridgeProxyConfig

+ AllowedPrivateCIDRs serpent.StringArray

+ MITMCertFile serpent.String

+ MITMKeyFile serpent.String

+ TLSCertFile serpent.String

+ TLSKeyFile serpent.String

+ type AIBridgeSession struct

+ Client *string

+ EndedAt *time.Time

+ ID string

+ Initiator MinimalUser

+ LastPrompt *string

+ Metadata map[string]any

+ Models []string

+ Providers []string

+ StartedAt time.Time

+ Threads int64

+ TokenUsageSummary AIBridgeSessionTokenUsageSummary

+ type AIBridgeSessionThreadsResponse struct

+ Client *string

+ EndedAt *time.Time

+ ID string

+ Initiator MinimalUser

+ Metadata map[string]any

+ Models []string

+ PageEndedAt *time.Time

+ PageStartedAt *time.Time

+ Providers []string

+ StartedAt time.Time

+ Threads []AIBridgeThread

+ TokenUsageSummary AIBridgeSessionThreadsTokenUsage

+ type AIBridgeSessionThreadsTokenUsage struct

+ CacheReadInputTokens int64

+ CacheWriteInputTokens int64

+ InputTokens int64

+ Metadata map[string]any

+ OutputTokens int64

+ type AIBridgeSessionTokenUsageSummary struct

+ CacheReadInputTokens int64

+ CacheWriteInputTokens int64

+ InputTokens int64

+ OutputTokens int64

+ type AIBridgeThread struct

+ AgenticActions []AIBridgeAgenticAction

+ EndedAt *time.Time

+ ID uuid.UUID

+ Model string

+ Prompt *string

+ Provider string

+ StartedAt time.Time

+ TokenUsage AIBridgeSessionThreadsTokenUsage

type AIBridgeTokenUsage

+ CacheReadInputTokens int64

+ CacheWriteInputTokens int64

+ type AIBridgeToolCall struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Injected bool

+ Input string

+ InterceptionID uuid.UUID

+ Metadata map[string]any

+ ProviderResponseID string

+ ServerURL string

+ Tool string

type AIConfig

+ Chat ChatConfig

type APIKeyScope

+ const APIKeyScopeChatAll

+ const APIKeyScopeChatCreate

+ const APIKeyScopeChatDelete

+ const APIKeyScopeChatRead

+ const APIKeyScopeChatUpdate

type Chat

+ AgentID *uuid.UUID

+ Archived bool

+ BuildID *uuid.UUID

+ DiffStatus *ChatDiffStatus

+ Files []ChatFileMetadata

+ HasUnread bool

+ Labels map[string]string

+ LastError *string

+ LastInjectedContext []ChatMessagePart

+ LastModelConfigID uuid.UUID

+ MCPServerIDs []uuid.UUID

+ OwnerID uuid.UUID

+ ParentChatID *uuid.UUID

+ PinOrder int32

+ RootChatID *uuid.UUID

+ Status ChatStatus

+ Warnings []string

+ WorkspaceID *uuid.UUID

+ type ChatBusyBehavior string

+ const ChatBusyBehaviorInterrupt

+ const ChatBusyBehaviorQueue

+ type ChatConfig struct

+ AcquireBatchSize serpent.Int64

+ type ChatCostChatBreakdown struct

+ ChatTitle string

+ MessageCount int64

+ RootChatID uuid.UUID

+ TotalCacheCreationTokens int64

+ TotalCacheReadTokens int64

+ TotalCostMicros int64

+ TotalInputTokens int64

+ TotalOutputTokens int64

+ TotalRuntimeMs int64

+ type ChatCostModelBreakdown struct

+ DisplayName string

+ MessageCount int64

+ Model string

+ ModelConfigID uuid.UUID

+ Provider string

+ TotalCacheCreationTokens int64

+ TotalCacheReadTokens int64

+ TotalCostMicros int64

+ TotalInputTokens int64

+ TotalOutputTokens int64

+ TotalRuntimeMs int64

+ type ChatCostSummary struct

+ ByChat []ChatCostChatBreakdown

+ ByModel []ChatCostModelBreakdown

+ EndDate time.Time

+ PricedMessageCount int64

+ StartDate time.Time

+ TotalCacheCreationTokens int64

+ TotalCacheReadTokens int64

+ TotalCostMicros int64

+ TotalInputTokens int64

+ TotalOutputTokens int64

+ TotalRuntimeMs int64

+ UnpricedMessageCount int64

+ UsageLimit *ChatUsageLimitStatus

+ type ChatCostSummaryOptions struct

+ EndDate time.Time

+ StartDate time.Time

+ type ChatCostUserRollup struct

+ AvatarURL string

+ ChatCount int64

+ MessageCount int64

+ Name string

+ TotalCacheCreationTokens int64

+ TotalCacheReadTokens int64

+ TotalCostMicros int64

+ TotalInputTokens int64

+ TotalOutputTokens int64

+ TotalRuntimeMs int64

+ UserID uuid.UUID

+ Username string

+ type ChatCostUsersOptions struct

+ EndDate time.Time

+ StartDate time.Time

+ Username string

+ type ChatCostUsersResponse struct

+ Count int64

+ EndDate time.Time

+ StartDate time.Time

+ Users []ChatCostUserRollup

+ type ChatDesktopEnabledResponse struct

+ EnableDesktop bool

+ type ChatDiffContents struct

+ Branch *string

+ ChatID uuid.UUID

+ Diff string

+ Provider *string

+ PullRequestURL *string

+ RemoteOrigin *string

+ type ChatDiffStatus struct

+ Additions int32

+ Approved *bool

+ AuthorAvatarURL *string

+ AuthorLogin *string

+ BaseBranch *string

+ ChangedFiles int32

+ ChangesRequested bool

+ ChatID uuid.UUID

+ Commits *int32

+ Deletions int32

+ HeadBranch *string

+ PRNumber *int32

+ PullRequestDraft bool

+ PullRequestState *string

+ PullRequestTitle string

+ RefreshedAt *time.Time

+ ReviewerCount *int32

+ StaleAt *time.Time

+ URL *string

+ type ChatFileMetadata struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ MimeType string

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ type ChatGitChange struct

+ ChangeType string

+ ChatID uuid.UUID

+ DetectedAt time.Time

+ DiffSummary *string

+ FilePath string

+ ID uuid.UUID

+ OldPath *string

+ type ChatInputPart struct

+ Content string

+ EndLine int

+ FileID uuid.UUID

+ FileName string

+ StartLine int

+ Text string

+ Type ChatInputPartType

+ type ChatInputPartType string

+ const ChatInputPartTypeFile

+ const ChatInputPartTypeFileReference

+ const ChatInputPartTypeText

type ChatMessage

+ ChatID uuid.UUID

+ Content []ChatMessagePart

+ CreatedAt time.Time

+ CreatedBy *uuid.UUID

+ ID int64

+ ModelConfigID *uuid.UUID

+ Role ChatMessageRole

+ Usage *ChatMessageUsage

+ type ChatMessagePart struct

+ Args json.RawMessage

+ ArgsDelta string

+ Content string

+ ContextFileAgentID uuid.NullUUID

+ ContextFileContent string

+ ContextFileDirectory string

+ ContextFileOS string

+ ContextFilePath string

+ ContextFileSkillMetaFile string

+ ContextFileTruncated bool

+ Data []byte

+ EndLine int

+ FileID uuid.NullUUID

+ FileName string

+ IsError bool

+ IsMedia bool

+ MCPServerConfigID uuid.NullUUID

+ MediaType string

+ ProviderExecuted bool

+ ProviderMetadata json.RawMessage

+ Result json.RawMessage

+ ResultDelta string

+ Signature string

+ SkillDescription string

+ SkillDir string

+ SkillName string

+ SourceID string

+ StartLine int

+ Text string

+ Title string

+ ToolCallID string

+ ToolName string

+ Type ChatMessagePartType

+ URL string

+ func ChatMessageFile(fileID uuid.UUID, mediaType string) ChatMessagePart

+ func ChatMessageFileReference(fileName string, startLine, endLine int, content string) ChatMessagePart

+ func ChatMessageReasoning(text string) ChatMessagePart

+ func ChatMessageSource(sourceID, sourceURL, title string) ChatMessagePart

+ func ChatMessageText(text string) ChatMessagePart

+ func ChatMessageToolCall(toolCallID, toolName string, args json.RawMessage) ChatMessagePart

+ func ChatMessageToolResult(toolCallID, toolName string, result json.RawMessage, isError bool, ...) ChatMessagePart

+ func (p *ChatMessagePart) StripInternal()

+ type ChatMessagePartType string

+ const ChatMessagePartTypeContextFile

+ const ChatMessagePartTypeFile

+ const ChatMessagePartTypeFileReference

+ const ChatMessagePartTypeReasoning

+ const ChatMessagePartTypeSkill

+ const ChatMessagePartTypeSource

+ const ChatMessagePartTypeText

+ const ChatMessagePartTypeToolCall

+ const ChatMessagePartTypeToolResult

+ func AllChatMessagePartTypes() []ChatMessagePartType

+ type ChatMessageRole string

+ const ChatMessageRoleAssistant

+ const ChatMessageRoleSystem

+ const ChatMessageRoleTool

+ const ChatMessageRoleUser

+ type ChatMessageUsage struct

+ CacheCreationTokens *int64

+ CacheReadTokens *int64

+ ContextLimit *int64

+ InputTokens *int64

+ OutputTokens *int64

+ ReasoningTokens *int64

+ TotalTokens *int64

+ type ChatMessagesPaginationOptions struct

+ BeforeID int64

+ Limit int

+ type ChatMessagesResponse struct

+ HasMore bool

+ Messages []ChatMessage

+ QueuedMessages []ChatQueuedMessage

+ type ChatModel struct

+ DisplayName string

+ ID string

+ Model string

+ Provider string

+ type ChatModelAnthropicProviderOptions struct

+ AllowedDomains []string

+ BlockedDomains []string

+ DisableParallelToolUse *bool

+ Effort *string

+ SendReasoning *bool

+ Thinking *ChatModelAnthropicThinkingOptions

+ WebSearchEnabled *bool

+ type ChatModelAnthropicThinkingOptions struct

+ BudgetTokens *int64

+ type ChatModelCallConfig struct

+ Cost *ModelCostConfig

+ FrequencyPenalty *float64

+ MaxOutputTokens *int64

+ PresencePenalty *float64

+ ProviderOptions *ChatModelProviderOptions

+ Temperature *float64

+ TopK *int64

+ TopP *float64

+ func (c *ChatModelCallConfig) UnmarshalJSON(data []byte) error

+ type ChatModelConfig struct

+ CompressionThreshold int32

+ ContextLimit int64

+ CreatedAt time.Time

+ DisplayName string

+ Enabled bool

+ ID uuid.UUID

+ IsDefault bool

+ Model string

+ ModelConfig *ChatModelCallConfig

+ Provider string

+ UpdatedAt time.Time

+ type ChatModelGoogleProviderOptions struct

+ CachedContent string

+ SafetySettings []ChatModelGoogleSafetySetting

+ ThinkingConfig *ChatModelGoogleThinkingConfig

+ Threshold string

+ WebSearchEnabled *bool

+ type ChatModelGoogleSafetySetting struct

+ Category string

+ Threshold string

+ type ChatModelGoogleThinkingConfig struct

+ IncludeThoughts *bool

+ ThinkingBudget *int64

+ type ChatModelOpenAICompatProviderOptions struct

+ ReasoningEffort *string

+ User *string

+ type ChatModelOpenAIProviderOptions struct

+ AllowedDomains []string

+ Include []string

+ Instructions *string

+ LogProbs *bool

+ LogitBias map[string]int64

+ MaxCompletionTokens *int64

+ MaxToolCalls *int64

+ Metadata map[string]any

+ ParallelToolCalls *bool

+ Prediction map[string]any

+ PromptCacheKey *string

+ ReasoningEffort *string

+ ReasoningSummary *string

+ SafetyIdentifier *string

+ SearchContextSize *string

+ ServiceTier *string

+ Store *bool

+ StrictJSONSchema *bool

+ StructuredOutputs *bool

+ TextVerbosity *string

+ TopLogProbs *int64

+ User *string

+ WebSearchEnabled *bool

+ type ChatModelOpenRouterProvider struct

+ AllowFallbacks *bool

+ DataCollection *string

+ Ignore []string

+ Only []string

+ Order []string

+ Quantizations []string

+ RequireParameters *bool

+ Sort *string

+ type ChatModelOpenRouterProviderOptions struct

+ ExtraBody map[string]any

+ IncludeUsage *bool

+ LogProbs *bool

+ LogitBias map[string]int64

+ ParallelToolCalls *bool

+ Provider *ChatModelOpenRouterProvider

+ Reasoning *ChatModelReasoningOptions

+ User *string

+ type ChatModelProvider struct

+ Available bool

+ Models []ChatModel

+ Provider string

+ UnavailableReason ChatModelProviderUnavailableReason

+ type ChatModelProviderOptions struct

+ Anthropic *ChatModelAnthropicProviderOptions

+ Google *ChatModelGoogleProviderOptions

+ OpenAI *ChatModelOpenAIProviderOptions

+ OpenAICompat *ChatModelOpenAICompatProviderOptions

+ OpenRouter *ChatModelOpenRouterProviderOptions

+ Vercel *ChatModelVercelProviderOptions

+ type ChatModelProviderUnavailableReason string

+ const ChatModelProviderUnavailableFetchFailed

+ const ChatModelProviderUnavailableMissingAPIKey

+ const ChatModelProviderUnavailableReasonUserAPIKeyRequired

+ type ChatModelReasoningOptions struct

+ Effort *string

+ Enabled *bool

+ Exclude *bool

+ MaxTokens *int64

+ type ChatModelVercelGatewayProviderOptions struct

+ Models []string

+ Order []string

+ type ChatModelVercelProviderOptions struct

+ ExtraBody map[string]any

+ LogProbs *bool

+ LogitBias map[string]int64

+ ParallelToolCalls *bool

+ ProviderOptions *ChatModelVercelGatewayProviderOptions

+ Reasoning *ChatModelReasoningOptions

+ TopLogProbs *int64

+ User *string

+ type ChatModelsResponse struct

+ Providers []ChatModelProvider

+ type ChatProviderConfig struct

+ AllowCentralAPIKeyFallback bool

+ AllowUserAPIKey bool

+ BaseURL string

+ CentralAPIKeyEnabled bool

+ CreatedAt time.Time

+ DisplayName string

+ Enabled bool

+ HasAPIKey bool

+ ID uuid.UUID

+ Provider string

+ Source ChatProviderConfigSource

+ UpdatedAt time.Time

+ type ChatProviderConfigSource string

+ const ChatProviderConfigSourceDatabase

+ const ChatProviderConfigSourceEnvPreset

+ const ChatProviderConfigSourceSupported

+ type ChatQueuedMessage struct

+ ChatID uuid.UUID

+ Content []ChatMessagePart

+ CreatedAt time.Time

+ ID int64

+ type ChatStatus string

+ const ChatStatusCompleted

+ const ChatStatusError

+ const ChatStatusPaused

+ const ChatStatusPending

+ const ChatStatusRunning

+ const ChatStatusWaiting

+ type ChatStreamError struct

+ Kind string

+ Message string

+ Provider string

+ Retryable bool

+ StatusCode int

+ type ChatStreamEvent struct

+ ChatID uuid.UUID

+ Error *ChatStreamError

+ Message *ChatMessage

+ MessagePart *ChatStreamMessagePart

+ QueuedMessages []ChatQueuedMessage

+ Retry *ChatStreamRetry

+ Status *ChatStreamStatus

+ Type ChatStreamEventType

+ type ChatStreamEventType string

+ const ChatStreamEventTypeError

+ const ChatStreamEventTypeMessage

+ const ChatStreamEventTypeMessagePart

+ const ChatStreamEventTypeQueueUpdate

+ const ChatStreamEventTypeRetry

+ const ChatStreamEventTypeStatus

+ type ChatStreamMessagePart struct

+ Part ChatMessagePart

+ Role ChatMessageRole

+ type ChatStreamRetry struct

+ Attempt int

+ DelayMs int64

+ Error string

+ Kind string

+ Provider string

+ RetryingAt time.Time

+ StatusCode int

+ type ChatStreamStatus struct

+ Status ChatStatus

+ type ChatSystemPromptResponse struct

+ DefaultSystemPrompt string

+ IncludeDefaultSystemPrompt bool

+ SystemPrompt string

+ type ChatTemplateAllowlist struct

+ TemplateIDs []string

+ type ChatUsageLimitConfig struct

+ Period ChatUsageLimitPeriod

+ SpendLimitMicros *int64

+ UpdatedAt time.Time

+ type ChatUsageLimitConfigResponse struct

+ GroupOverrides []ChatUsageLimitGroupOverride

+ Overrides []ChatUsageLimitOverride

+ UnpricedModelCount int64

+ type ChatUsageLimitExceededResponse struct

+ LimitMicros int64

+ ResetsAt time.Time

+ SpentMicros int64

+ func ChatUsageLimitExceededFrom(err error) *ChatUsageLimitExceededResponse

+ type ChatUsageLimitGroupOverride struct

+ GroupAvatarURL string

+ GroupDisplayName string

+ GroupID uuid.UUID

+ GroupName string

+ MemberCount int64

+ SpendLimitMicros *int64

+ type ChatUsageLimitOverride struct

+ AvatarURL string

+ Name string

+ SpendLimitMicros *int64

+ UserID uuid.UUID

+ Username string

+ type ChatUsageLimitPeriod string

+ const ChatUsageLimitPeriodDay

+ const ChatUsageLimitPeriodMonth

+ const ChatUsageLimitPeriodWeek

+ func (p ChatUsageLimitPeriod) Valid() bool

+ type ChatUsageLimitStatus struct

+ CurrentSpend int64

+ IsLimited bool

+ Period ChatUsageLimitPeriod

+ PeriodEnd time.Time

+ PeriodStart time.Time

+ SpendLimitMicros *int64

+ type ChatWorkspaceTTLResponse struct

+ WorkspaceTTLMillis int64

type Client

+ func (c *Client) AIBridgeGetSessionThreads(ctx context.Context, sessionID string, afterID, beforeID uuid.UUID, ...) (AIBridgeSessionThreadsResponse, error)

+ func (c *Client) AIBridgeListClients(ctx context.Context) ([]string, error)

+ func (c *Client) AIBridgeListSessions(ctx context.Context, filter AIBridgeListSessionsFilter) (AIBridgeListSessionsResponse, error)

+ func (c *Client) CreateMCPServerConfig(ctx context.Context, req CreateMCPServerConfigRequest) (MCPServerConfig, error)

+ func (c *Client) DebugCollectProfile(ctx context.Context, opts DebugProfileOptions) (io.ReadCloser, error)

+ func (c *Client) DeleteMCPServerConfig(ctx context.Context, id uuid.UUID) error

+ func (c *Client) GroupMembers(ctx context.Context, group uuid.UUID, req UsersRequest) (GroupMembersResponse, error)

+ func (c *Client) MCPServerConfigByID(ctx context.Context, id uuid.UUID) (MCPServerConfig, error)

+ func (c *Client) MCPServerConfigs(ctx context.Context) ([]MCPServerConfig, error)

+ func (c *Client) MCPServerOAuth2ConnectURL(id uuid.UUID) string

+ func (c *Client) MCPServerOAuth2Disconnect(ctx context.Context, id uuid.UUID) error

+ func (c *Client) OrganizationMembersPaginated(ctx context.Context, organizationID uuid.UUID, req UsersRequest) (PaginatedMembersResponse, error)

+ func (c *Client) UpdateMCPServerConfig(ctx context.Context, id uuid.UUID, req UpdateMCPServerConfigRequest) (MCPServerConfig, error)

+ func (c *Client) UserOIDCClaims(ctx context.Context) (OIDCClaimsResponse, error)

+ func (c *Client) WatchAllWorkspaceBuilds(ctx context.Context) (*wsjson.Decoder[WorkspaceBuildUpdate], error)

type CreateChatMessageRequest

+ BusyBehavior ChatBusyBehavior

+ Content []ChatInputPart

+ MCPServerIDs *[]uuid.UUID

+ ModelConfigID *uuid.UUID

+ type CreateChatMessageResponse struct

+ Message *ChatMessage

+ Queued bool

+ QueuedMessage *ChatQueuedMessage

+ Warnings []string

+ type CreateChatModelConfigRequest struct

+ CompressionThreshold *int32

+ ContextLimit *int64

+ DisplayName string

+ Enabled *bool

+ IsDefault *bool

+ Model string

+ ModelConfig *ChatModelCallConfig

+ Provider string

+ type CreateChatProviderConfigRequest struct

+ APIKey string

+ AllowCentralAPIKeyFallback *bool

+ AllowUserAPIKey *bool

+ BaseURL string

+ CentralAPIKeyEnabled *bool

+ DisplayName string

+ Enabled *bool

+ Provider string

+ type CreateChatRequest struct

+ Content []ChatInputPart

+ Labels map[string]string

+ MCPServerIDs []uuid.UUID

+ ModelConfigID *uuid.UUID

+ SystemPrompt string

+ WorkspaceID *uuid.UUID

+ type CreateFirstUserOnboardingInfo struct

+ NewsletterMarketing bool

+ NewsletterReleases bool

type CreateFirstUserRequest

+ OnboardingInfo *CreateFirstUserOnboardingInfo

+ type CreateMCPServerConfigRequest struct

+ APIKeyHeader string

+ APIKeyValue string

+ AuthType string

+ Availability string

+ CustomHeaders map[string]string

+ Description string

+ DisplayName string

+ Enabled bool

+ IconURL string

+ ModelIntent bool

+ OAuth2AuthURL string

+ OAuth2ClientID string

+ OAuth2ClientSecret string

+ OAuth2Scopes string

+ OAuth2TokenURL string

+ Slug string

+ ToolAllowList []string

+ ToolDenyList []string

+ Transport string

+ URL string

+ type CreateUserChatProviderKeyRequest struct

+ APIKey string

type CreateUserRequestWithOrgs

+ ServiceAccount bool

+ type DebugProfileOptions struct

+ Duration time.Duration

+ Profiles []string

type DeploymentValues

+ ExternalAuthGithubDefaultProviderEnable serpent.Bool

+ type EditChatMessageRequest struct

+ Content []ChatInputPart

+ type EditChatMessageResponse struct

+ Message ChatMessage

+ Warnings []string

type Experiment

+ const ExperimentAgents

+ const ExperimentWorkspaceBuildUpdates

type ExperimentalClient

+ func (c *ExperimentalClient) CreateChat(ctx context.Context, req CreateChatRequest) (Chat, error)

+ func (c *ExperimentalClient) CreateChatMessage(ctx context.Context, chatID uuid.UUID, req CreateChatMessageRequest) (CreateChatMessageResponse, error)

+ func (c *ExperimentalClient) CreateChatModelConfig(ctx context.Context, req CreateChatModelConfigRequest) (ChatModelConfig, error)

+ func (c *ExperimentalClient) CreateChatProvider(ctx context.Context, req CreateChatProviderConfigRequest) (ChatProviderConfig, error)

+ func (c *ExperimentalClient) DeleteChatModelConfig(ctx context.Context, modelConfigID uuid.UUID) error

+ func (c *ExperimentalClient) DeleteChatProvider(ctx context.Context, providerID uuid.UUID) error

+ func (c *ExperimentalClient) DeleteChatUsageLimitGroupOverride(ctx context.Context, groupID uuid.UUID) error

+ func (c *ExperimentalClient) DeleteChatUsageLimitOverride(ctx context.Context, userID uuid.UUID) error

+ func (c *ExperimentalClient) DeleteChatUserUsageLimitOverride(ctx context.Context, userID uuid.UUID) error

+ func (c *ExperimentalClient) DeleteUserChatCompactionThreshold(ctx context.Context, modelConfigID uuid.UUID) error

+ func (c *ExperimentalClient) DeleteUserChatProviderKey(ctx context.Context, providerID uuid.UUID) error

+ func (c *ExperimentalClient) EditChatMessage(ctx context.Context, chatID uuid.UUID, messageID int64, ...) (EditChatMessageResponse, error)

+ func (c *ExperimentalClient) GetChat(ctx context.Context, chatID uuid.UUID) (Chat, error)

+ func (c *ExperimentalClient) GetChatCostSummary(ctx context.Context, user string, opts ChatCostSummaryOptions) (ChatCostSummary, error)

+ func (c *ExperimentalClient) GetChatCostUsers(ctx context.Context, opts ChatCostUsersOptions) (ChatCostUsersResponse, error)

+ func (c *ExperimentalClient) GetChatDesktopEnabled(ctx context.Context) (ChatDesktopEnabledResponse, error)

+ func (c *ExperimentalClient) GetChatDiffContents(ctx context.Context, chatID uuid.UUID) (ChatDiffContents, error)

+ func (c *ExperimentalClient) GetChatFile(ctx context.Context, fileID uuid.UUID) ([]byte, string, error)

+ func (c *ExperimentalClient) GetChatGitChanges(ctx context.Context, chatID uuid.UUID) ([]ChatGitChange, error)

+ func (c *ExperimentalClient) GetChatMessages(ctx context.Context, chatID uuid.UUID, opts *ChatMessagesPaginationOptions) (ChatMessagesResponse, error)

+ func (c *ExperimentalClient) GetChatSystemPrompt(ctx context.Context) (ChatSystemPromptResponse, error)

+ func (c *ExperimentalClient) GetChatTemplateAllowlist(ctx context.Context) (ChatTemplateAllowlist, error)

+ func (c *ExperimentalClient) GetChatUsageLimitConfig(ctx context.Context) (ChatUsageLimitConfigResponse, error)

+ func (c *ExperimentalClient) GetChatWorkspaceTTL(ctx context.Context) (ChatWorkspaceTTLResponse, error)

+ func (c *ExperimentalClient) GetChatsByWorkspace(ctx context.Context, workspaceIDs []uuid.UUID) (map[uuid.UUID]uuid.UUID, error)

+ func (c *ExperimentalClient) GetMyChatUsageLimitStatus(ctx context.Context) (ChatUsageLimitStatus, error)

+ func (c *ExperimentalClient) GetUserChatCompactionThresholds(ctx context.Context) (UserChatCompactionThresholds, error)

+ func (c *ExperimentalClient) GetUserChatCustomPrompt(ctx context.Context) (UserChatCustomPrompt, error)

+ func (c *ExperimentalClient) InterruptChat(ctx context.Context, chatID uuid.UUID) (Chat, error)

+ func (c *ExperimentalClient) ListChatModelConfigs(ctx context.Context) ([]ChatModelConfig, error)

+ func (c *ExperimentalClient) ListChatModels(ctx context.Context) (ChatModelsResponse, error)

+ func (c *ExperimentalClient) ListChatProviders(ctx context.Context) ([]ChatProviderConfig, error)

+ func (c *ExperimentalClient) ListChats(ctx context.Context, opts *ListChatsOptions) ([]Chat, error)

+ func (c *ExperimentalClient) ListUserChatProviderConfigs(ctx context.Context) ([]UserChatProviderConfig, error)

+ func (c *ExperimentalClient) RegenerateChatTitle(ctx context.Context, chatID uuid.UUID) (Chat, error)

+ func (c *ExperimentalClient) StreamChat(ctx context.Context, chatID uuid.UUID, opts *StreamChatOptions) (<-chan ChatStreamEvent, io.Closer, error)

+ func (c *ExperimentalClient) UpdateChat(ctx context.Context, chatID uuid.UUID, req UpdateChatRequest) error

+ func (c *ExperimentalClient) UpdateChatDesktopEnabled(ctx context.Context, req UpdateChatDesktopEnabledRequest) error

+ func (c *ExperimentalClient) UpdateChatModelConfig(ctx context.Context, modelConfigID uuid.UUID, req UpdateChatModelConfigRequest) (ChatModelConfig, error)

+ func (c *ExperimentalClient) UpdateChatProvider(ctx context.Context, providerID uuid.UUID, req UpdateChatProviderConfigRequest) (ChatProviderConfig, error)

+ func (c *ExperimentalClient) UpdateChatSystemPrompt(ctx context.Context, req UpdateChatSystemPromptRequest) error

+ func (c *ExperimentalClient) UpdateChatTemplateAllowlist(ctx context.Context, req ChatTemplateAllowlist) error

+ func (c *ExperimentalClient) UpdateChatUsageLimitConfig(ctx context.Context, req ChatUsageLimitConfig) (ChatUsageLimitConfig, error)

+ func (c *ExperimentalClient) UpdateChatUserUsageLimitOverride(ctx context.Context, userID uuid.UUID, req UpdateChatUsageLimitOverrideRequest) (ChatUsageLimitOverride, error)

+ func (c *ExperimentalClient) UpdateChatWorkspaceTTL(ctx context.Context, req UpdateChatWorkspaceTTLRequest) error

+ func (c *ExperimentalClient) UpdateUserChatCompactionThreshold(ctx context.Context, modelConfigID uuid.UUID, ...) (UserChatCompactionThreshold, error)

+ func (c *ExperimentalClient) UpdateUserChatCustomPrompt(ctx context.Context, req UserChatCustomPrompt) (UserChatCustomPrompt, error)

+ func (c *ExperimentalClient) UploadChatFile(ctx context.Context, organizationID uuid.UUID, contentType string, ...) (UploadChatFileResponse, error)

+ func (c *ExperimentalClient) UpsertChatUsageLimitGroupOverride(ctx context.Context, groupID uuid.UUID, ...) (ChatUsageLimitGroupOverride, error)

+ func (c *ExperimentalClient) UpsertChatUsageLimitOverride(ctx context.Context, userID uuid.UUID, req UpsertChatUsageLimitOverrideRequest) (ChatUsageLimitOverride, error)

+ func (c *ExperimentalClient) UpsertUserChatProviderKey(ctx context.Context, providerID uuid.UUID, ...) (UserChatProviderConfig, error)

type ExternalAuthConfig

+ APIBaseURL string

type FeatureName

+ const FeatureServiceAccounts

type GetUserStatusCountsRequest

+ Timezone string

+ type GroupMembersResponse struct

+ Count int

+ Users []ReducedUser

+ type GroupRequest struct

+ ExcludeMembers bool

+ type ListChatsOptions struct

+ Labels map[string]string

+ Query string

+ type MCPServerConfig struct

+ APIKeyHeader string

+ AuthConnected bool

+ AuthType string

+ Availability string

+ CreatedAt time.Time

+ Description string

+ DisplayName string

+ Enabled bool

+ HasAPIKey bool

+ HasCustomHeaders bool

+ HasOAuth2Secret bool

+ ID uuid.UUID

+ IconURL string

+ ModelIntent bool

+ OAuth2AuthURL string

+ OAuth2ClientID string

+ OAuth2Scopes string

+ OAuth2TokenURL string

+ Slug string

+ ToolAllowList []string

+ ToolDenyList []string

+ Transport string

+ URL string

+ UpdatedAt time.Time

+ type ModelCostConfig struct

+ CacheReadPricePerMillionTokens *decimal.Decimal

+ CacheWritePricePerMillionTokens *decimal.Decimal

+ InputPricePerMillionTokens *decimal.Decimal

+ OutputPricePerMillionTokens *decimal.Decimal

+ type OIDCClaimsResponse struct

+ Claims map[string]interface{}

type OrganizationMemberWithUserData

+ HasAISeat bool

+ IsServiceAccount bool

+ LastSeenAt time.Time

+ LoginType LoginType

+ Status UserStatus

+ UserCreatedAt time.Time

+ UserUpdatedAt time.Time

+ type PRInsightsModelBreakdown struct

+ CostPerMergedPRMicros int64

+ DisplayName string

+ MergeRate float64

+ MergedPRs int64

+ ModelConfigID uuid.UUID

+ Provider string

+ TotalAdditions int64

+ TotalCostMicros int64

+ TotalDeletions int64

+ TotalPRs int64

+ type PRInsightsPullRequest struct

+ Additions int32

+ Approved *bool

+ AuthorAvatarURL *string

+ AuthorLogin *string

+ BaseBranch string

+ ChangedFiles int32

+ ChangesRequested bool

+ ChatID uuid.UUID

+ Commits *int32

+ CostMicros int64

+ CreatedAt time.Time

+ Deletions int32

+ Draft bool

+ ModelDisplayName string

+ PRNumber *int32

+ PRTitle string

+ PRURL *string

+ ReviewerCount *int32

+ State string

+ type PRInsightsResponse struct

+ ByModel []PRInsightsModelBreakdown

+ RecentPRs []PRInsightsPullRequest

+ Summary PRInsightsSummary

+ TimeSeries []PRInsightsTimeSeriesEntry

+ type PRInsightsSummary struct

+ ApprovalRate float64

+ CostPerMergedPRMicros int64

+ MergeRate float64

+ PrevCostPerMergedPRMicros int64

+ PrevMergeRate float64

+ PrevTotalPRsCreated int64

+ PrevTotalPRsMerged int64

+ TotalAdditions int64

+ TotalCostMicros int64

+ TotalDeletions int64

+ TotalPRsCreated int64

+ TotalPRsMerged int64

+ type PRInsightsTimeSeriesEntry struct

+ Date time.Time

+ PRsClosed int64

+ PRsCreated int64

+ PRsMerged int64

type ReducedUser

+ IsServiceAccount bool

type ResourceType

+ const ResourceTypeAISeat

+ type ShareableWorkspaceOwners string

+ const ShareableWorkspaceOwnersEveryone

+ const ShareableWorkspaceOwnersNone

+ const ShareableWorkspaceOwnersServiceAccounts

+ type StreamChatOptions struct

+ AfterID *int64

type TerminalFontName

+ const TerminalFontGeistMono

+ type UpdateChatDesktopEnabledRequest struct

+ EnableDesktop bool

+ type UpdateChatModelConfigRequest struct

+ CompressionThreshold *int32

+ ContextLimit *int64

+ DisplayName string

+ Enabled *bool

+ IsDefault *bool

+ Model string

+ ModelConfig *ChatModelCallConfig

+ Provider string

+ type UpdateChatProviderConfigRequest struct

+ APIKey *string

+ AllowCentralAPIKeyFallback *bool

+ AllowUserAPIKey *bool

+ BaseURL *string

+ CentralAPIKeyEnabled *bool

+ DisplayName string

+ Enabled *bool

+ type UpdateChatRequest struct

+ Archived *bool

+ Labels *map[string]string

+ PinOrder *int32

+ Title *string

+ type UpdateChatSystemPromptRequest struct

+ IncludeDefaultSystemPrompt *bool

+ SystemPrompt string

+ type UpdateChatUsageLimitGroupOverrideRequest = UpsertChatUsageLimitGroupOverrideRequest

+ type UpdateChatUsageLimitOverrideRequest = UpsertChatUsageLimitOverrideRequest

+ type UpdateChatWorkspaceTTLRequest struct

+ WorkspaceTTLMillis int64

+ type UpdateMCPServerConfigRequest struct

+ APIKeyHeader *string

+ APIKeyValue *string

+ AuthType *string

+ Availability *string

+ CustomHeaders *map[string]string

+ Description *string

+ DisplayName *string

+ Enabled *bool

+ IconURL *string

+ ModelIntent *bool

+ OAuth2AuthURL *string

+ OAuth2ClientID *string

+ OAuth2ClientSecret *string

+ OAuth2Scopes *string

+ OAuth2TokenURL *string

+ Slug *string

+ ToolAllowList *[]string

+ ToolDenyList *[]string

+ Transport *string

+ URL *string

+ type UpdateUserChatCompactionThresholdRequest struct

+ ThresholdPercent int32

+ type UpdateWorkspaceSharingSettingsRequest struct

+ ShareableWorkspaceOwners ShareableWorkspaceOwners

+ SharingDisabled bool

+ type UploadChatFileResponse struct

+ ID uuid.UUID

+ type UpsertChatUsageLimitGroupOverrideRequest struct

+ SpendLimitMicros int64

+ type UpsertChatUsageLimitOverrideRequest struct

+ SpendLimitMicros int64

type User

+ HasAISeat bool

+ type UserChatCompactionThreshold struct

+ ModelConfigID uuid.UUID

+ ThresholdPercent int32

+ type UserChatCompactionThresholds struct

+ Thresholds []UserChatCompactionThreshold

+ type UserChatCustomPrompt struct

+ CustomPrompt string

+ type UserChatProviderConfig struct

+ DisplayName string

+ HasCentralAPIKeyFallback bool

+ HasUserAPIKey bool

+ Provider string

+ ProviderID uuid.UUID

type WebpushMessage

+ Data map[string]string

+ Tag string

+ type WorkspaceAgentGitClientMessage struct

+ Type WorkspaceAgentGitClientMessageType

+ type WorkspaceAgentGitClientMessageType string

+ const WorkspaceAgentGitClientMessageTypeRefresh

+ type WorkspaceAgentGitServerMessage struct

+ Message string

+ Repositories []WorkspaceAgentRepoChanges

+ ScannedAt *time.Time

+ Type WorkspaceAgentGitServerMessageType

+ type WorkspaceAgentGitServerMessageType string

+ const WorkspaceAgentGitServerMessageTypeChanges

+ const WorkspaceAgentGitServerMessageTypeError

+ type WorkspaceAgentRepoChanges struct

+ Branch string

+ RemoteOrigin string

+ Removed bool

+ RepoRoot string

+ UnifiedDiff string

+ type WorkspaceBuildUpdate struct

+ BuildID uuid.UUID

+ BuildNumber int32

+ JobStatus string

+ Transition string

+ WorkspaceID uuid.UUID

+ WorkspaceName string

type WorkspaceSharingSettings

+ ShareableWorkspaceOwners ShareableWorkspaceOwners

+ SharingGloballyDisabled bool

type WorkspaceTransition

+ func WorkspaceTransitionEnums() []WorkspaceTransition

Mar 24, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 19, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 1, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 28, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 9, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 9, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 1, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 25, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 13, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 10, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 6, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 4, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 3, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AIBridgeInterception

+ Client *string

type AIBridgeListInterceptionsFilter

+ Client string

type APIKeyScope

+ const APIKeyScopeWorkspaceDormantUpdateAgent

+ const APIKeyScopeWorkspaceUpdateAgent

type BuildReason

+ const BuildReasonTaskAutoPause

+ const BuildReasonTaskManualPause

+ const BuildReasonTaskResume

type Client

+ func (c *Client) EvaluateTemplateVersion(ctx context.Context, templateVersionID uuid.UUID, ownerID uuid.UUID, ...) (DynamicParametersResponse, error)

+ func (c *Client) ExpireAPIKey(ctx context.Context, userID string, id string) error

+ func (c *Client) OrganizationMember(ctx context.Context, organizationIdent, userIdent string) (OrganizationMemberWithUserData, error)

+ func (c *Client) PauseTask(ctx context.Context, user string, id uuid.UUID) (PauseTaskResponse, error)

+ func (c *Client) ResumeTask(ctx context.Context, user string, id uuid.UUID) (ResumeTaskResponse, error)

+ func (c *Client) WorkspaceAvailableUsers(ctx context.Context, organizationID uuid.UUID, userID string) ([]MinimalUser, error)

type CreateWorkspaceBuildReason

+ const CreateWorkspaceBuildReasonTaskManualPause

+ const CreateWorkspaceBuildReasonTaskResume

type Error

+ func NewError(statusCode int, response Response) *Error

type HTTPCookieConfig

+ EnableHostPrefix bool

+ func (cfg *HTTPCookieConfig) Middleware(next http.Handler) http.Handler

type OIDCConfig

+ RedirectURL serpent.URL

+ type PauseTaskResponse struct

+ WorkspaceBuild *WorkspaceBuild

type PreviewParameter

+ func (p PreviewParameter) TemplateVersionParameter() TemplateVersionParameter

type PreviewParameterOption

+ func (o PreviewParameterOption) TemplateVersionParameterOption() TemplateVersionParameterOption

type ProvisionerJobLog

+ func (l ProvisionerJobLog) Text() string

type RBACAction

+ const ActionUpdateAgent

+ type ResumeTaskResponse struct

+ WorkspaceBuild *WorkspaceBuild

type TaskLogsResponse

+ Snapshot bool

+ SnapshotAt *time.Time

type Template

+ Deleted bool

+ DisableModuleCache bool

type TokensFilter

+ IncludeExpired bool

type UpdateTemplateMeta

+ DisableModuleCache *bool

type UsersRequest

+ Name string

type WorkspaceAgentDevcontainer

+ SubagentID uuid.NullUUID

+ func (d WorkspaceAgentDevcontainer) IsTerraformDefined() bool

type WorkspaceAgentLog

+ func (l WorkspaceAgentLog) Text(agentName, sourceName string) string

Feb 23, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 9, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 1, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 25, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 16, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 3, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 23, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 10, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 3, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const OAuth2PKCEVerifier

+ const PostgresConnMaxIdleAuto

+ var AddonsMap = func() map[Addon]struct{} { ... }()

+ var AddonsNames = []Addon

+ func ComputeMaxIdleConns(maxOpen int, configuredIdle string) (int, error)

+ func ValidatePKCECodeChallengeMethod(method string) error

type AIBridgeBedrockConfig

+ BaseURL serpent.String

type AIBridgeConfig

+ CircuitBreakerEnabled serpent.Bool

+ CircuitBreakerFailureThreshold serpent.Int64

+ CircuitBreakerInterval serpent.Duration

+ CircuitBreakerMaxRequests serpent.Int64

+ CircuitBreakerTimeout serpent.Duration

+ MaxConcurrency serpent.Int64

+ RateLimit serpent.Int64

+ SendActorHeaders serpent.Bool

+ StructuredLogging serpent.Bool

+ type AIBridgeProxyConfig struct

+ CertFile serpent.String

+ DomainAllowlist serpent.StringArray

+ Enabled serpent.Bool

+ KeyFile serpent.String

+ ListenAddr serpent.String

+ UpstreamProxy serpent.String

+ UpstreamProxyCA serpent.String

type AIConfig

+ BridgeProxyConfig AIBridgeProxyConfig

type APIKeyScope

+ const APIKeyScopeBoundaryUsageAll

+ const APIKeyScopeBoundaryUsageDelete

+ const APIKeyScopeBoundaryUsageRead

+ const APIKeyScopeBoundaryUsageUpdate

+ type Addon string

+ const AddonAIGovernance

+ func (a Addon) Features() []FeatureName

+ func (a Addon) Humanize() string

+ func (a Addon) ValidateDependencies(features map[FeatureName]Feature) []string

type Client

+ func (c *Client) PatchWorkspaceSharingSettings(ctx context.Context, orgID string, req WorkspaceSharingSettings) (WorkspaceSharingSettings, error)

+ func (c *Client) WorkspaceAgentDeleteDevcontainer(ctx context.Context, agentID uuid.UUID, devcontainerID string) error

+ func (c *Client) WorkspaceSharingSettings(ctx context.Context, orgID string) (WorkspaceSharingSettings, error)

type DeploymentValues

+ DisableWorkspaceSharing serpent.Bool

+ PostgresConnMaxIdle serpent.String

+ PostgresConnMaxOpen serpent.Int64

+ Retention RetentionConfig

+ StatsCollection StatsCollectionConfig

type ExternalAuthConfig

+ CodeChallengeMethodsSupported []string

type ExternalAuthLinkProvider

+ CodeChallengeMethodsSupported []string

type FeatureName

+ const FeatureAIGovernanceUserLimit

+ const FeatureBoundary

+ const FeatureTaskBatchActions

+ func (n FeatureName) IsAIGovernanceAddon() bool

+ func (n FeatureName) IsAddonFeature() bool

+ type OAuth2Error struct

+ Error OAuth2ErrorCode

+ ErrorDescription string

+ ErrorURI string

+ type OAuth2ErrorCode string

+ const OAuth2ErrorCodeAccessDenied

+ const OAuth2ErrorCodeInvalidClient

+ const OAuth2ErrorCodeInvalidGrant

+ const OAuth2ErrorCodeInvalidRequest

+ const OAuth2ErrorCodeInvalidScope

+ const OAuth2ErrorCodeInvalidTarget

+ const OAuth2ErrorCodeServerError

+ const OAuth2ErrorCodeTemporarilyUnavailable

+ const OAuth2ErrorCodeUnauthorizedClient

+ const OAuth2ErrorCodeUnsupportedGrantType

+ const OAuth2ErrorCodeUnsupportedResponseType

+ const OAuth2ErrorCodeUnsupportedTokenType

+ func (c OAuth2ErrorCode) Valid() bool

+ type OAuth2PKCECodeChallengeMethod string

+ const OAuth2PKCECodeChallengeMethodPlain

+ const OAuth2PKCECodeChallengeMethodS256

+ func (m OAuth2PKCECodeChallengeMethod) Valid() bool

type OAuth2ProviderGrantType

+ const OAuth2ProviderGrantTypeClientCredentials

+ const OAuth2ProviderGrantTypeImplicit

+ const OAuth2ProviderGrantTypePassword

type OAuth2ProviderResponseType

+ const OAuth2ProviderResponseTypeToken

+ type OAuth2RevocationTokenTypeHint string

+ const OAuth2RevocationTokenTypeHintAccessToken

+ const OAuth2RevocationTokenTypeHintRefreshToken

+ func (h OAuth2RevocationTokenTypeHint) Valid() bool

+ type OAuth2TokenEndpointAuthMethod string

+ const OAuth2TokenEndpointAuthMethodClientSecretBasic

+ const OAuth2TokenEndpointAuthMethodClientSecretPost

+ const OAuth2TokenEndpointAuthMethodNone

+ func (m OAuth2TokenEndpointAuthMethod) Valid() bool

+ type OAuth2TokenRequest struct

+ ClientID string

+ ClientSecret string

+ Code string

+ CodeVerifier string

+ GrantType OAuth2ProviderGrantType

+ RedirectURI string

+ RefreshToken string

+ Resource string

+ Scope string

+ type OAuth2TokenResponse struct

+ AccessToken string

+ ExpiresIn int64

+ Expiry *time.Time

+ RefreshToken string

+ Scope string

+ TokenType OAuth2TokenType

+ type OAuth2TokenRevocationRequest struct

+ ClientID string

+ ClientSecret string

+ Token string

+ TokenTypeHint OAuth2RevocationTokenTypeHint

+ type OAuth2TokenType string

+ const OAuth2TokenTypeBearer

+ const OAuth2TokenTypeDPoP

+ func (t OAuth2TokenType) Valid() bool

type RBACResource

+ const ResourceBoundaryUsage

+ type RetentionConfig struct

+ APIKeys serpent.Duration

+ AuditLogs serpent.Duration

+ ConnectionLogs serpent.Duration

+ WorkspaceAgentLogs serpent.Duration

+ type SharedWorkspaceActor struct

+ ActorType SharedWorkspaceActorType

+ AvatarURL string

+ ID uuid.UUID

+ Name string

+ Roles []WorkspaceRole

+ type SharedWorkspaceActorType string

+ const SharedWorkspaceActorTypeGroup

+ const SharedWorkspaceActorTypeUser

+ type StatsCollectionConfig struct

+ UsageStats UsageStatsConfig

+ type UsageStatsConfig struct

+ Enable serpent.Bool

type Workspace

+ SharedWith []SharedWorkspaceActor

type WorkspaceAgentDevcontainerStatus

+ const WorkspaceAgentDevcontainerStatusDeleting

+ const WorkspaceAgentDevcontainerStatusStopping

+ func (s WorkspaceAgentDevcontainerStatus) Transitioning() bool

+ type WorkspaceSharingSettings struct

+ SharingDisabled bool

Jun 17, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Changes in this version

type OIDCConfig

+ AutoRepairLinks serpent.Bool

Jun 12, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Changes in this version

+ func ValidateSSHConfigOption(key, value string) error

+ func ValidateSSHConfigOptions(options map[string]string) error

+ func ValidateWorkspaceHostnamePrefix(prefix string) error

+ func ValidateWorkspaceHostnameSuffix(suffix string) error

type SSHConfigResponse

+ func (r SSHConfigResponse) Validate() error

May 30, 2026 GO-2026-5906 +16 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 19, 2026 GO-2026-5906 +16 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +16 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +16 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 1, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 28, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 10, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AuditLogResponse

+ CountCap int64

type ConnectionLogResponse

+ CountCap int64

Mar 25, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 3, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 23, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LicenseManagedAgentLimitExceededWarningText

Feb 5, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 3, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 29, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 26, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 21, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 9, 2025 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 2, 2025 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AIBridgeConfig

+ InjectCoderMCPTools serpent.Bool

+ Retention serpent.Duration

type AIBridgeInterception

+ APIKeyID *string

type Client

+ func (c *Client) CreateTask(ctx context.Context, user string, request CreateTaskRequest) (Task, error)

+ func (c *Client) DeleteTask(ctx context.Context, user string, id uuid.UUID) error

+ func (c *Client) GetUserPreferenceSettings(ctx context.Context, user string) (UserPreferenceSettings, error)

+ func (c *Client) InvalidateTemplatePresets(ctx context.Context, template uuid.UUID) (InvalidatePresetsResponse, error)

+ func (c *Client) TaskByID(ctx context.Context, id uuid.UUID) (Task, error)

+ func (c *Client) TaskByIdentifier(ctx context.Context, identifier string) (Task, error)

+ func (c *Client) TaskByOwnerAndName(ctx context.Context, owner, ident string) (Task, error)

+ func (c *Client) TaskLogs(ctx context.Context, user string, id uuid.UUID) (TaskLogsResponse, error)

+ func (c *Client) TaskSend(ctx context.Context, user string, id uuid.UUID, req TaskSendRequest) error

+ func (c *Client) Tasks(ctx context.Context, filter *TasksFilter) ([]Task, error)

+ func (c *Client) UpdateTaskInput(ctx context.Context, user string, id uuid.UUID, req UpdateTaskInputRequest) error

+ func (c *Client) UpdateUserPreferenceSettings(ctx context.Context, user string, req UpdateUserPreferenceSettingsRequest) (UserPreferenceSettings, error)

type CreateTaskRequest

+ DisplayName string

type Experiment

+ const ExperimentTerraformWorkspace

+ type InvalidatePresetsResponse struct

+ Invalidated []InvalidatedPreset

+ type InvalidatedPreset struct

+ PresetName string

+ TemplateName string

+ TemplateVersionName string

type OAuth2AuthorizationServerMetadata

+ RevocationEndpoint string

type Task

+ DisplayName string

type Template

+ UseTerraformWorkspaceCache bool

+ type UpdateTaskInputRequest struct

+ Input string

type UpdateTemplateMeta

+ UseTerraformWorkspaceCache *bool

+ type UpdateUserPreferenceSettingsRequest struct

+ TaskNotificationAlertDismissed bool

+ type UserPreferenceSettings struct

+ TaskNotificationAlertDismissed bool

Feb 23, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 3, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 29, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 26, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 20, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 9, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 1, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 27, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 12, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 11, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 10, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 4, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ func JobIsMissingRequiredTemplateVariableErrorCode(code JobErrorCode) bool

+ type AIBridgeBedrockConfig struct

+ AccessKey serpent.String

+ AccessKeySecret serpent.String

+ Model serpent.String

+ Region serpent.String

+ SmallFastModel serpent.String

type AIBridgeConfig

+ Bedrock AIBridgeBedrockConfig

type AIBridgeInterception

+ EndedAt *time.Time

+ Initiator MinimalUser

type AIBridgeListInterceptionsResponse

+ Count int64

+ type APIAllowListTarget struct

+ ID string

+ Type RBACResource

+ func AllowAllTarget() APIAllowListTarget

+ func AllowResourceTarget(r RBACResource, id uuid.UUID) APIAllowListTarget

+ func AllowTypeTarget(r RBACResource) APIAllowListTarget

+ func (t *APIAllowListTarget) UnmarshalJSON(b []byte) error

+ func (t *APIAllowListTarget) UnmarshalText(b []byte) error

+ func (t APIAllowListTarget) MarshalJSON() ([]byte, error)

+ func (t APIAllowListTarget) MarshalText() ([]byte, error)

+ func (t APIAllowListTarget) String() string

type APIKey

+ AllowList []APIAllowListTarget

type APIKeyScope

+ const APIKeyScopeAibridgeInterceptionAll

+ const APIKeyScopeAibridgeInterceptionCreate

+ const APIKeyScopeAibridgeInterceptionRead

+ const APIKeyScopeAibridgeInterceptionUpdate

+ const APIKeyScopeAssignOrgRoleAll

+ const APIKeyScopeAssignOrgRoleAssign

+ const APIKeyScopeAssignOrgRoleCreate

+ const APIKeyScopeAssignOrgRoleDelete

+ const APIKeyScopeAssignOrgRoleRead

+ const APIKeyScopeAssignOrgRoleUnassign

+ const APIKeyScopeAssignOrgRoleUpdate

+ const APIKeyScopeAssignRoleAll

+ const APIKeyScopeAssignRoleAssign

+ const APIKeyScopeAssignRoleRead

+ const APIKeyScopeAssignRoleUnassign

+ const APIKeyScopeAuditLogAll

+ const APIKeyScopeAuditLogCreate

+ const APIKeyScopeAuditLogRead

+ const APIKeyScopeConnectionLogAll

+ const APIKeyScopeConnectionLogRead

+ const APIKeyScopeConnectionLogUpdate

+ const APIKeyScopeCryptoKeyAll

+ const APIKeyScopeCryptoKeyCreate

+ const APIKeyScopeCryptoKeyDelete

+ const APIKeyScopeCryptoKeyRead

+ const APIKeyScopeCryptoKeyUpdate

+ const APIKeyScopeDebugInfoAll

+ const APIKeyScopeDebugInfoRead

+ const APIKeyScopeDeploymentConfigAll

+ const APIKeyScopeDeploymentConfigRead

+ const APIKeyScopeDeploymentConfigUpdate

+ const APIKeyScopeDeploymentStatsAll

+ const APIKeyScopeDeploymentStatsRead

+ const APIKeyScopeGroupAll

+ const APIKeyScopeGroupCreate

+ const APIKeyScopeGroupDelete

+ const APIKeyScopeGroupMemberAll

+ const APIKeyScopeGroupMemberRead

+ const APIKeyScopeGroupRead

+ const APIKeyScopeGroupUpdate

+ const APIKeyScopeIdpsyncSettingsAll

+ const APIKeyScopeIdpsyncSettingsRead

+ const APIKeyScopeIdpsyncSettingsUpdate

+ const APIKeyScopeInboxNotificationAll

+ const APIKeyScopeInboxNotificationCreate

+ const APIKeyScopeInboxNotificationRead

+ const APIKeyScopeInboxNotificationUpdate

+ const APIKeyScopeLicenseAll

+ const APIKeyScopeLicenseCreate

+ const APIKeyScopeLicenseDelete

+ const APIKeyScopeLicenseRead

+ const APIKeyScopeNotificationMessageAll

+ const APIKeyScopeNotificationMessageCreate

+ const APIKeyScopeNotificationMessageDelete

+ const APIKeyScopeNotificationMessageRead

+ const APIKeyScopeNotificationMessageUpdate

+ const APIKeyScopeNotificationPreferenceAll

+ const APIKeyScopeNotificationPreferenceRead

+ const APIKeyScopeNotificationPreferenceUpdate

+ const APIKeyScopeNotificationTemplateAll

+ const APIKeyScopeNotificationTemplateRead

+ const APIKeyScopeNotificationTemplateUpdate

+ const APIKeyScopeOauth2AppAll

+ const APIKeyScopeOauth2AppCodeTokenAll

+ const APIKeyScopeOauth2AppCodeTokenCreate

+ const APIKeyScopeOauth2AppCodeTokenDelete

+ const APIKeyScopeOauth2AppCodeTokenRead

+ const APIKeyScopeOauth2AppCreate

+ const APIKeyScopeOauth2AppDelete

+ const APIKeyScopeOauth2AppRead

+ const APIKeyScopeOauth2AppSecretAll

+ const APIKeyScopeOauth2AppSecretCreate

+ const APIKeyScopeOauth2AppSecretDelete

+ const APIKeyScopeOauth2AppSecretRead

+ const APIKeyScopeOauth2AppSecretUpdate

+ const APIKeyScopeOauth2AppUpdate

+ const APIKeyScopeOrganizationAll

+ const APIKeyScopeOrganizationCreate

+ const APIKeyScopeOrganizationDelete

+ const APIKeyScopeOrganizationMemberAll

+ const APIKeyScopeOrganizationMemberCreate

+ const APIKeyScopeOrganizationMemberDelete

+ const APIKeyScopeOrganizationMemberRead

+ const APIKeyScopeOrganizationMemberUpdate

+ const APIKeyScopeOrganizationRead

+ const APIKeyScopeOrganizationUpdate

+ const APIKeyScopePrebuiltWorkspaceAll

+ const APIKeyScopePrebuiltWorkspaceDelete

+ const APIKeyScopePrebuiltWorkspaceUpdate

+ const APIKeyScopeProvisionerDaemonAll

+ const APIKeyScopeProvisionerDaemonCreate

+ const APIKeyScopeProvisionerDaemonDelete

+ const APIKeyScopeProvisionerDaemonRead

+ const APIKeyScopeProvisionerDaemonUpdate

+ const APIKeyScopeProvisionerJobsAll

+ const APIKeyScopeProvisionerJobsCreate

+ const APIKeyScopeProvisionerJobsRead

+ const APIKeyScopeProvisionerJobsUpdate

+ const APIKeyScopeReplicasAll

+ const APIKeyScopeReplicasRead

+ const APIKeyScopeSystemAll

+ const APIKeyScopeSystemCreate

+ const APIKeyScopeSystemDelete

+ const APIKeyScopeSystemRead

+ const APIKeyScopeSystemUpdate

+ const APIKeyScopeTailnetCoordinatorAll

+ const APIKeyScopeTailnetCoordinatorCreate

+ const APIKeyScopeTailnetCoordinatorDelete

+ const APIKeyScopeTailnetCoordinatorRead

+ const APIKeyScopeTailnetCoordinatorUpdate

+ const APIKeyScopeTaskAll

+ const APIKeyScopeTaskCreate

+ const APIKeyScopeTaskDelete

+ const APIKeyScopeTaskRead

+ const APIKeyScopeTaskUpdate

+ const APIKeyScopeTemplateViewInsights

+ const APIKeyScopeUsageEventAll

+ const APIKeyScopeUsageEventCreate

+ const APIKeyScopeUsageEventRead

+ const APIKeyScopeUsageEventUpdate

+ const APIKeyScopeUserAll

+ const APIKeyScopeUserCreate

+ const APIKeyScopeUserDelete

+ const APIKeyScopeUserRead

+ const APIKeyScopeUserUpdate

+ const APIKeyScopeWebpushSubscriptionAll

+ const APIKeyScopeWebpushSubscriptionCreate

+ const APIKeyScopeWebpushSubscriptionDelete

+ const APIKeyScopeWebpushSubscriptionRead

+ const APIKeyScopeWorkspaceAgentDevcontainersAll

+ const APIKeyScopeWorkspaceAgentDevcontainersCreate

+ const APIKeyScopeWorkspaceAgentResourceMonitorAll

+ const APIKeyScopeWorkspaceAgentResourceMonitorCreate

+ const APIKeyScopeWorkspaceAgentResourceMonitorRead

+ const APIKeyScopeWorkspaceAgentResourceMonitorUpdate

+ const APIKeyScopeWorkspaceCreateAgent

+ const APIKeyScopeWorkspaceDeleteAgent

+ const APIKeyScopeWorkspaceDormantAll

+ const APIKeyScopeWorkspaceDormantApplicationConnect

+ const APIKeyScopeWorkspaceDormantCreate

+ const APIKeyScopeWorkspaceDormantCreateAgent

+ const APIKeyScopeWorkspaceDormantDelete

+ const APIKeyScopeWorkspaceDormantDeleteAgent

+ const APIKeyScopeWorkspaceDormantRead

+ const APIKeyScopeWorkspaceDormantShare

+ const APIKeyScopeWorkspaceDormantSsh

+ const APIKeyScopeWorkspaceDormantStart

+ const APIKeyScopeWorkspaceDormantStop

+ const APIKeyScopeWorkspaceDormantUpdate

+ const APIKeyScopeWorkspaceProxyAll

+ const APIKeyScopeWorkspaceProxyCreate

+ const APIKeyScopeWorkspaceProxyDelete

+ const APIKeyScopeWorkspaceProxyRead

+ const APIKeyScopeWorkspaceProxyUpdate

+ const APIKeyScopeWorkspaceShare

type Client

+ func (c *Client) AIBridgeListInterceptions(ctx context.Context, filter AIBridgeListInterceptionsFilter) (AIBridgeListInterceptionsResponse, error)

+ func (c *Client) RevokeOAuth2Token(ctx context.Context, clientID uuid.UUID, token string) error

type CreateTokenRequest

+ AllowList []APIAllowListTarget

type CustomRoleRequest

+ OrganizationMemberPermissions []Permission

type DeploymentValues

+ EnableAuthzRecording serpent.Bool

type Error

+ func NewTestError(statusCode int, method string, u string) *Error

type ExperimentalClient

+ func (c *ExperimentalClient) TaskByIdentifier(ctx context.Context, identifier string) (Task, error)

type LinkConfig

+ Location string

type MinimalUser

+ Name string

type OAuth2AppEndpoints

+ TokenRevoke string

type OrganizationProvisionerJobsOptions

+ Initiator string

type ProvisionerJob

+ InitiatorID uuid.UUID

type RBACAction

+ const ActionShare

type RBACResource

+ const ResourceTask

type ResourceType

+ const ResourceTypeTask

type Role

+ OrganizationMemberPermissions []Permission

type Task

+ OwnerAvatarURL string

+ TemplateVersionID uuid.UUID

+ WorkspaceAppID uuid.NullUUID

+ WorkspaceBuildNumber int32

+ WorkspaceName string

+ WorkspaceStatus WorkspaceStatus

+ type TaskStatus string

+ const TaskStatusActive

+ const TaskStatusError

+ const TaskStatusInitializing

+ const TaskStatusPaused

+ const TaskStatusPending

+ const TaskStatusUnknown

+ func AllTaskStatuses() []TaskStatus

type TasksFilter

+ FilterQuery string

+ Organization string

+ type TasksListResponse struct

+ Count int

+ Tasks []Task

type VariableValue

+ func CombineVariableValues(valuesSets ...[]VariableValue) []VariableValue

type Workspace

+ TaskID uuid.NullUUID

Jan 26, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 20, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type Client

+ func (c *Client) UpdateWorkspaceBuildState(ctx context.Context, build uuid.UUID, state []byte) error

+ type UpdateWorkspaceBuildStateRequest struct

+ State []byte

Dec 9, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 1, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 27, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 12, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 11, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 10, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 30, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 28, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 16, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 2, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ var PublicAPIKeyScopes = []APIKeyScope

+ type AIBridgeAnthropicConfig struct

+ BaseURL serpent.String

+ Key serpent.String

+ type AIBridgeConfig struct

+ Anthropic AIBridgeAnthropicConfig

+ Enabled serpent.Bool

+ OpenAI AIBridgeOpenAIConfig

+ type AIBridgeInterception struct

+ ID uuid.UUID

+ InitiatorID uuid.UUID

+ Metadata map[string]any

+ Model string

+ Provider string

+ StartedAt time.Time

+ TokenUsages []AIBridgeTokenUsage

+ ToolUsages []AIBridgeToolUsage

+ UserPrompts []AIBridgeUserPrompt

+ type AIBridgeListInterceptionsFilter struct

+ FilterQuery string

+ Initiator string

+ Model string

+ Pagination Pagination

+ Provider string

+ StartedAfter time.Time

+ StartedBefore time.Time

+ type AIBridgeListInterceptionsResponse struct

+ Results []AIBridgeInterception

+ type AIBridgeOpenAIConfig struct

+ BaseURL serpent.String

+ Key serpent.String

+ type AIBridgeTokenUsage struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ InputTokens int64

+ InterceptionID uuid.UUID

+ Metadata map[string]any

+ OutputTokens int64

+ ProviderResponseID string

+ type AIBridgeToolUsage struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Injected bool

+ Input string

+ InterceptionID uuid.UUID

+ InvocationError string

+ Metadata map[string]any

+ ProviderResponseID string

+ ServerURL string

+ Tool string

+ type AIBridgeUserPrompt struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ InterceptionID uuid.UUID

+ Metadata map[string]any

+ Prompt string

+ ProviderResponseID string

type AIConfig

+ BridgeConfig AIBridgeConfig

type APIKey

+ Scopes []APIKeyScope

type APIKeyScope

+ const APIKeyScopeApiKeyAll

+ const APIKeyScopeApiKeyCreate

+ const APIKeyScopeApiKeyDelete

+ const APIKeyScopeApiKeyRead

+ const APIKeyScopeApiKeyUpdate

+ const APIKeyScopeCoderAll

+ const APIKeyScopeCoderApikeysManageSelf

+ const APIKeyScopeCoderApplicationConnect

+ const APIKeyScopeCoderTemplatesAuthor

+ const APIKeyScopeCoderTemplatesBuild

+ const APIKeyScopeCoderWorkspacesAccess

+ const APIKeyScopeCoderWorkspacesCreate

+ const APIKeyScopeCoderWorkspacesDelete

+ const APIKeyScopeCoderWorkspacesOperate

+ const APIKeyScopeFileAll

+ const APIKeyScopeFileCreate

+ const APIKeyScopeFileRead

+ const APIKeyScopeTemplateAll

+ const APIKeyScopeTemplateCreate

+ const APIKeyScopeTemplateDelete

+ const APIKeyScopeTemplateRead

+ const APIKeyScopeTemplateUpdate

+ const APIKeyScopeTemplateUse

+ const APIKeyScopeUserReadPersonal

+ const APIKeyScopeUserSecretAll

+ const APIKeyScopeUserSecretCreate

+ const APIKeyScopeUserSecretDelete

+ const APIKeyScopeUserSecretRead

+ const APIKeyScopeUserSecretUpdate

+ const APIKeyScopeUserUpdatePersonal

+ const APIKeyScopeWorkspaceAll

+ const APIKeyScopeWorkspaceApplicationConnect

+ const APIKeyScopeWorkspaceCreate

+ const APIKeyScopeWorkspaceDelete

+ const APIKeyScopeWorkspaceRead

+ const APIKeyScopeWorkspaceSsh

+ const APIKeyScopeWorkspaceStart

+ const APIKeyScopeWorkspaceStop

+ const APIKeyScopeWorkspaceUpdate

type Client

+ SessionTokenProvider SessionTokenProvider

+ func (c *Client) DeleteWorkspaceACL(ctx context.Context, workspaceID uuid.UUID) error

+ func (c *Client) PostCustomNotification(ctx context.Context, req CustomNotificationRequest) error

+ func (c *Client) RequestWithoutSessionToken(ctx context.Context, method, path string, body interface{}, ...) (*http.Response, error)

+ type ClientOption func(*Client)

+ func WithDisableDirectConnections() ClientOption

+ func WithHTTPClient(httpClient *http.Client) ClientOption

+ func WithLogBodies() ClientOption

+ func WithLogger(logger slog.Logger) ClientOption

+ func WithPlainLogger(plainLogger io.Writer) ClientOption

+ func WithSessionToken(token string) ClientOption

+ func WithTrace() ClientOption

type CreateTaskRequest

+ Input string

+ Name string

type CreateTokenRequest

+ Scopes []APIKeyScope

+ type CustomNotificationContent struct

+ Message string

+ Title string

+ func (c CustomNotificationContent) Validate() error

+ type CustomNotificationRequest struct

+ Content *CustomNotificationContent

+ func (c CustomNotificationRequest) Validate() error

+ type DeleteExternalAuthByIDResponse struct

+ TokenRevocationError string

+ TokenRevoked bool

type DeploymentValues

+ func (c *DeploymentValues) Validate() error

type Experiment

+ const ExperimentAIBridge

type ExperimentalClient

+ func (c *ExperimentalClient) AIBridgeListInterceptions(ctx context.Context, filter AIBridgeListInterceptionsFilter) (AIBridgeListInterceptionsResponse, error)

+ func (c *ExperimentalClient) DeleteTask(ctx context.Context, user string, id uuid.UUID) error

+ func (c *ExperimentalClient) TaskLogs(ctx context.Context, user string, id uuid.UUID) (TaskLogsResponse, error)

+ func (c *ExperimentalClient) TaskSend(ctx context.Context, user string, id uuid.UUID, req TaskSendRequest) error

+ type ExternalAPIKeyScopes struct

+ External []APIKeyScope

type ExternalAuth

+ SupportsRevocation bool

type ExternalAuthConfig

+ MCPToolAllowRegex string

+ MCPToolDenyRegex string

+ MCPURL string

+ RevokeURL string

type ExternalAuthLinkProvider

+ SupportsRevocation bool

type FeatureName

+ const FeatureAIBridge

+ type FixedSessionTokenProvider struct

+ SessionToken string

+ SessionTokenHeader string

+ func (f FixedSessionTokenProvider) AsRequestOption() RequestOption

+ func (f FixedSessionTokenProvider) GetSessionToken() string

+ func (f FixedSessionTokenProvider) SetDialOption(opts *websocket.DialOptions)

+ type OrganizationMembersQuery struct

+ GithubUserID int64

+ IncludeSystem bool

+ UserID uuid.UUID

+ func (omq OrganizationMembersQuery) AsRequestOption() RequestOption

+ type OrganizationMembersQueryOption func(*OrganizationMembersQuery)

+ func OrganizationMembersQueryOptionGithubUserID(githubUserID int64) OrganizationMembersQueryOption

+ func OrganizationMembersQueryOptionIncludeSystem() OrganizationMembersQueryOption

+ func OrganizationMembersQueryOptionUserID(userID uuid.UUID) OrganizationMembersQueryOption

type RBACResource

+ const ResourceAibridgeInterception

type SessionLifetime

+ RefreshDefaultDuration serpent.Duration

+ type SessionTokenProvider interface

+ AsRequestOption func() RequestOption

+ GetSessionToken func() string

+ SetDialOption func(options *websocket.DialOptions)

type Task

+ OwnerName string

+ TemplateDisplayName string

+ TemplateIcon string

+ TemplateName string

+ WorkspaceAgentHealth *WorkspaceAgentHealth

+ WorkspaceAgentID uuid.NullUUID

+ WorkspaceAgentLifecycle *WorkspaceAgentLifecycle

+ type TaskLogEntry struct

+ Content string

+ ID int

+ Time time.Time

+ Type TaskLogType

+ type TaskLogType string

+ const TaskLogTypeInput

+ const TaskLogTypeOutput

+ type TaskLogsResponse struct

+ Logs []TaskLogEntry

+ type TaskSendRequest struct

+ Input string

type TaskState

+ const TaskStateComplete

type WorkspaceApp

+ Tooltip string

type WorkspaceFilter

+ Shared *bool

+ SharedWithGroup string

+ SharedWithUser string

Dec 1, 2025 GO-2026-5897 +16 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 27, 2025 GO-2026-5897 +16 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 10, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 28, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 16, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 1, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 3, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type CORSBehavior string

+ const CORSBehaviorPassthru

+ const CORSBehaviorSimple

type Client

+ func (c *Client) InitScript(ctx context.Context, os, arch string) (string, error)

+ func (c *Client) UpdateWorkspaceACL(ctx context.Context, workspaceID uuid.UUID, req UpdateWorkspaceACL) error

+ func (c *Client) WorkspaceACL(ctx context.Context, workspaceID uuid.UUID) (WorkspaceACL, error)

+ func (c *Client) WorkspaceExternalAgentCredentials(ctx context.Context, workspaceID uuid.UUID, agentName string) (ExternalAgentCredentials, error)

+ type CreateTaskRequest struct

+ Prompt string

+ TemplateVersionID uuid.UUID

+ TemplateVersionPresetID uuid.UUID

type CreateTemplateRequest

+ CORSBehavior *CORSBehavior

type Experiment

+ const ExperimentWorkspaceSharing

type ExperimentalClient

+ func (c *ExperimentalClient) CreateTask(ctx context.Context, user string, request CreateTaskRequest) (Workspace, error)

+ func (c *ExperimentalClient) TaskByID(ctx context.Context, id uuid.UUID) (Task, error)

+ func (c *ExperimentalClient) Tasks(ctx context.Context, filter *TasksFilter) ([]Task, error)

+ type ExternalAgentCredentials struct

+ AgentToken string

+ Command string

type FeatureName

+ const FeatureWorkspaceExternalAgent

type OrganizationProvisionerDaemonsOptions

+ MaxAge time.Duration

+ Offline bool

+ Status []ProvisionerDaemonStatus

type ProvisionerDaemonStatus

+ func ProvisionerDaemonStatusEnums() []ProvisionerDaemonStatus

type ProvisionerJob

+ LogsOverflowed bool

type RBACResource

+ const ResourceUsageEvent

+ const ResourceUserSecret

+ type Task struct

+ CreatedAt time.Time

+ CurrentState *TaskStateEntry

+ ID uuid.UUID

+ InitialPrompt string

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ Status WorkspaceStatus

+ TemplateID uuid.UUID

+ UpdatedAt time.Time

+ WorkspaceID uuid.NullUUID

+ type TaskState string

+ const TaskStateCompleted

+ const TaskStateFailed

+ const TaskStateIdle

+ const TaskStateWorking

+ type TaskStateEntry struct

+ Message string

+ State TaskState

+ Timestamp time.Time

+ URI string

+ type TasksFilter struct

+ Limit int

+ Offset int

+ Owner string

+ Status string

type Template

+ CORSBehavior CORSBehavior

type TemplateFilter

+ AuthorUsername string

type TemplateVersion

+ HasExternalAgent bool

type UpdateTemplateMeta

+ CORSBehavior *CORSBehavior

+ type UpdateWorkspaceACL struct

+ GroupRoles map[string]WorkspaceRole

+ UserRoles map[string]WorkspaceRole

+ type WorkspaceACL struct

+ Groups []WorkspaceGroup

+ Users []WorkspaceUser

type WorkspaceBuild

+ HasExternalAgent *bool

+ type WorkspaceGroup struct

+ Role WorkspaceRole

+ type WorkspaceRole string

+ const WorkspaceRoleAdmin

+ const WorkspaceRoleDeleted

+ const WorkspaceRoleUse

+ type WorkspaceUser struct

+ Role WorkspaceRole

Oct 1, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 3, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 7, 2025 GO-2025-3938 +18 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 5, 2025 GO-2025-3938 +18 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ var FeatureNamesMap = func() map[FeatureName]struct{} { ... }()

type BuildReason

+ const BuildReasonCLI

+ const BuildReasonDashboard

+ const BuildReasonJetbrainsConnection

+ const BuildReasonSSHConnection

+ const BuildReasonVSCodeConnection

+ type CancelWorkspaceBuildParams struct

+ ExpectStatus CancelWorkspaceBuildStatus

+ type CancelWorkspaceBuildStatus string

+ const CancelWorkspaceBuildStatusPending

+ const CancelWorkspaceBuildStatusRunning

type Client

+ func (c *Client) ConnectionLogs(ctx context.Context, req ConnectionLogsRequest) (ConnectionLogResponse, error)

+ func (c *Client) DeleteOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string) error

+ func (c *Client) GetOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string) (OAuth2ClientConfiguration, error)

+ func (c *Client) GetPrebuildsSettings(ctx context.Context) (PrebuildsSettings, error)

+ func (c *Client) PostOAuth2ClientRegistration(ctx context.Context, req OAuth2ClientRegistrationRequest) (OAuth2ClientRegistrationResponse, error)

+ func (c *Client) PutOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string, ...) (OAuth2ClientConfiguration, error)

+ func (c *Client) PutPrebuildsSettings(ctx context.Context, settings PrebuildsSettings) error

+ func (c *Client) WatchWorkspaceAgentContainers(ctx context.Context, agentID uuid.UUID) (<-chan WorkspaceAgentListContainersResponse, io.Closer, error)

+ type ConnectionLog struct

+ AgentName string

+ ConnectTime time.Time

+ ID uuid.UUID

+ IP netip.Addr

+ Organization MinimalOrganization

+ SSHInfo *ConnectionLogSSHInfo

+ Type ConnectionType

+ WebInfo *ConnectionLogWebInfo

+ WorkspaceID uuid.UUID

+ WorkspaceName string

+ WorkspaceOwnerID uuid.UUID

+ WorkspaceOwnerUsername string

+ type ConnectionLogResponse struct

+ ConnectionLogs []ConnectionLog

+ Count int64

+ type ConnectionLogSSHInfo struct

+ ConnectionID uuid.UUID

+ DisconnectReason string

+ DisconnectTime *time.Time

+ ExitCode *int32

+ type ConnectionLogStatus string

+ const ConnectionLogStatusCompleted

+ const ConnectionLogStatusOngoing

+ func (s ConnectionLogStatus) Valid() bool

+ type ConnectionLogWebInfo struct

+ SlugOrPort string

+ StatusCode int32

+ User *User

+ UserAgent string

+ type ConnectionLogsRequest struct

+ SearchQuery string

+ type ConnectionType string

+ const ConnectionTypeJetBrains

+ const ConnectionTypePortForwarding

+ const ConnectionTypeReconnectingPTY

+ const ConnectionTypeSSH

+ const ConnectionTypeVSCode

+ const ConnectionTypeWorkspaceApp

type CreateTemplateRequest

+ UseClassicParameterFlow *bool

+ type CreateWorkspaceBuildReason string

+ const CreateWorkspaceBuildReasonCLI

+ const CreateWorkspaceBuildReasonDashboard

+ const CreateWorkspaceBuildReasonJetbrainsConnection

+ const CreateWorkspaceBuildReasonSSHConnection

+ const CreateWorkspaceBuildReasonVSCodeConnection

type CreateWorkspaceBuildRequest

+ Reason CreateWorkspaceBuildReason

type Experiment

+ const ExperimentMCPServerHTTP

+ const ExperimentOAuth2

+ func (e Experiment) DisplayName() string

type Feature

+ SoftLimit *int64

+ UsagePeriod *UsagePeriod

type FeatureName

+ const FeatureConnectionLog

+ const FeatureManagedAgentLimit

+ func (n FeatureName) UsesLimit() bool

+ func (n FeatureName) UsesUsagePeriod() bool

+ type OAuth2AuthorizationServerMetadata struct

+ AuthorizationEndpoint string

+ CodeChallengeMethodsSupported []string

+ GrantTypesSupported []string

+ Issuer string

+ RegistrationEndpoint string

+ ResponseTypesSupported []string

+ ScopesSupported []string

+ TokenEndpoint string

+ TokenEndpointAuthMethodsSupported []string

+ type OAuth2ClientConfiguration struct

+ ClientID string

+ ClientIDIssuedAt int64

+ ClientName string

+ ClientSecretExpiresAt int64

+ ClientURI string

+ Contacts []string

+ GrantTypes []string

+ JWKS json.RawMessage

+ JWKSURI string

+ LogoURI string

+ PolicyURI string

+ RedirectURIs []string

+ RegistrationAccessToken string

+ RegistrationClientURI string

+ ResponseTypes []string

+ Scope string

+ SoftwareID string

+ SoftwareVersion string

+ TOSURI string

+ TokenEndpointAuthMethod string

+ type OAuth2ClientRegistrationRequest struct

+ ClientName string

+ ClientURI string

+ Contacts []string

+ GrantTypes []string

+ JWKS json.RawMessage

+ JWKSURI string

+ LogoURI string

+ PolicyURI string

+ RedirectURIs []string

+ ResponseTypes []string

+ Scope string

+ SoftwareID string

+ SoftwareStatement string

+ SoftwareVersion string

+ TOSURI string

+ TokenEndpointAuthMethod string

+ func (*OAuth2ClientRegistrationRequest) DetermineClientType() string

+ func (req *OAuth2ClientRegistrationRequest) GenerateClientName() string

+ func (req *OAuth2ClientRegistrationRequest) Validate() error

+ func (req OAuth2ClientRegistrationRequest) ApplyDefaults() OAuth2ClientRegistrationRequest

+ type OAuth2ClientRegistrationResponse struct

+ ClientID string

+ ClientIDIssuedAt int64

+ ClientName string

+ ClientSecret string

+ ClientSecretExpiresAt int64

+ ClientURI string

+ Contacts []string

+ GrantTypes []string

+ JWKS json.RawMessage

+ JWKSURI string

+ LogoURI string

+ PolicyURI string

+ RedirectURIs []string

+ RegistrationAccessToken string

+ RegistrationClientURI string

+ ResponseTypes []string

+ Scope string

+ SoftwareID string

+ SoftwareVersion string

+ TOSURI string

+ TokenEndpointAuthMethod string

+ type OAuth2ProtectedResourceMetadata struct

+ AuthorizationServers []string

+ BearerMethodsSupported []string

+ Resource string

+ ScopesSupported []string

+ type PrebuildsSettings struct

+ ReconciliationPaused bool

type Preset

+ Description string

+ DesiredPrebuildInstances *int

+ Icon string

type PreviewParameterStyling

+ MaskInput *bool

type RBACResource

+ const ResourceConnectionLog

type ResourceType

+ const ResourceTypePrebuildsSettings

+ type UsagePeriod struct

+ End time.Time

+ IssuedAt time.Time

+ Start time.Time

type Workspace

+ IsPrebuild bool

type WorkspaceAgentDevcontainer

+ Error string

+ func (d WorkspaceAgentDevcontainer) Equals(other WorkspaceAgentDevcontainer) bool

May 14, 2026 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 4, 2025 GO-2025-4182 +19 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 7, 2025 GO-2025-3938 +20 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 15, 2025 GO-2025-3938 +20 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type BuildReason

+ const BuildReasonDormancy

Jul 2, 2025 GO-2025-3938 +20 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 1, 2025 GO-2025-3938 +20 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const AITaskPromptParameterName

+ const WorkspaceAgentPortShareLevelOrganization

+ var ExperimentsKnown = Experiments

+ type AITasksPromptsResponse struct

+ Prompts map[string]string

type DeploymentValues

+ HideAITasks serpent.Bool

+ type ExperimentalClient struct

+ func NewExperimentalClient(client *Client) *ExperimentalClient

+ func (c *ExperimentalClient) AITaskPrompts(ctx context.Context, buildIDs []uuid.UUID) (AITasksPromptsResponse, error)

type Preset

+ Default bool

type RBACResource

+ const ResourcePrebuiltWorkspace

type SessionLifetime

+ MaximumAdminTokenDuration serpent.Duration

type TemplateVersionParameter

+ FormType string

type WorkspaceAgentDevcontainer

+ Agent *WorkspaceAgentDevcontainerAgent

+ type WorkspaceAgentDevcontainerAgent struct

+ Directory string

+ ID uuid.UUID

+ Name string

type WorkspaceAgentListContainersResponse

+ Devcontainers []WorkspaceAgentDevcontainer

type WorkspaceAgentPortShareLevel

+ func (l WorkspaceAgentPortShareLevel) IsCompatibleWithMaxLevel(maxLevel WorkspaceAgentPortShareLevel) error

type WorkspaceAppSharingLevel

+ const WorkspaceAppSharingLevelOrganization

type WorkspaceAppStatusState

+ const WorkspaceAppStatusStateIdle

type WorkspaceBuild

+ AITaskSidebarAppID *uuid.UUID

+ HasAITask *bool

Aug 7, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 15, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 8, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 30, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 10, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 3, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type AIConfig struct

+ Providers []AIProviderConfig

+ type AIProviderConfig struct

+ APIKey string

+ BaseURL string

+ Models []string

+ Type string

+ type Chat struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Title string

+ UpdatedAt time.Time

+ type ChatMessage = aisdk.Message

type Client

+ func (c *Client) Chat(ctx context.Context, id uuid.UUID) (Chat, error)

+ func (c *Client) ChatMessages(ctx context.Context, id uuid.UUID) ([]ChatMessage, error)

+ func (c *Client) ConvertUserLoginType(ctx context.Context, user string, req ConvertLoginRequest) (OAuthConversionResponse, error)

+ func (c *Client) CreateChat(ctx context.Context) (Chat, error)

+ func (c *Client) CreateChatMessage(ctx context.Context, id uuid.UUID, req CreateChatMessageRequest) (<-chan aisdk.DataStreamPart, error)

+ func (c *Client) DeleteChat(ctx context.Context, id uuid.UUID) error

+ func (c *Client) LanguageModelConfig(ctx context.Context) (LanguageModelConfig, error)

+ func (c *Client) ListChats(ctx context.Context) ([]Chat, error)

+ func (c *Client) WorkspaceAgentRecreateDevcontainer(ctx context.Context, agentID uuid.UUID, containerIDOrName string) (Response, error)

+ type CreateChatMessageRequest struct

+ Message ChatMessage

+ Model string

+ Thinking bool

type CreateWorkspaceBuildRequest

+ EnableDynamicParameters *bool

type DeploymentValues

+ AI serpent.Struct[AIConfig]

+ JobReaperDetectorInterval serpent.Duration

+ type DiagnosticExtra struct

+ Code string

+ type DiagnosticSeverityString string

+ const DiagnosticSeverityError

+ const DiagnosticSeverityWarning

type DynamicParametersRequest

+ OwnerID uuid.UUID

type Experiment

+ const ExperimentAITasks

+ const ExperimentAgenticChat

type FriendlyDiagnostic

+ Detail string

+ Extra DiagnosticExtra

+ Severity DiagnosticSeverityString

+ Summary string

+ type LanguageModel struct

+ DisplayName string

+ ID string

+ Provider string

+ type LanguageModelConfig struct

+ Models []LanguageModel

type NullHCLString

+ Valid bool

+ Value string

+ type OptionType string

+ const OptionTypeBoolean

+ const OptionTypeListString

+ const OptionTypeNumber

+ const OptionTypeString

+ type ParameterFormType string

+ const ParameterFormTypeCheckbox

+ const ParameterFormTypeDefault

+ const ParameterFormTypeDropdown

+ const ParameterFormTypeError

+ const ParameterFormTypeInput

+ const ParameterFormTypeMultiSelect

+ const ParameterFormTypeRadio

+ const ParameterFormTypeSlider

+ const ParameterFormTypeSwitch

+ const ParameterFormTypeTagSelect

+ const ParameterFormTypeTextArea

type PrebuildsConfig

+ FailureHardLimit serpent.Int64

+ type PreviewParameter struct

+ Diagnostics []FriendlyDiagnostic

+ Value NullHCLString

+ type PreviewParameterData struct

+ DefaultValue NullHCLString

+ Description string

+ DisplayName string

+ Ephemeral bool

+ FormType ParameterFormType

+ Icon string

+ Mutable bool

+ Name string

+ Options []PreviewParameterOption

+ Order int64

+ Required bool

+ Styling PreviewParameterStyling

+ Type OptionType

+ Validations []PreviewParameterValidation

+ type PreviewParameterOption struct

+ Description string

+ Icon string

+ Name string

+ Value NullHCLString

+ type PreviewParameterStyling struct

+ Disabled *bool

+ Label *string

+ Placeholder *string

+ type PreviewParameterValidation struct

+ Error string

+ Max *int64

+ Min *int64

+ Monotonic *string

+ Regex *string

type ProvisionerJob

+ WorkerName string

type RBACAction

+ const ActionCreateAgent

+ const ActionDeleteAgent

type RBACResource

+ const ResourceChat

type Template

+ UseClassicParameterFlow bool

type UpdateTemplateMeta

+ UseClassicParameterFlow *bool

type Workspace

+ TemplateUseClassicParameterFlow bool

type WorkspaceAgentContainer

+ DevcontainerDirty bool

+ DevcontainerStatus WorkspaceAgentDevcontainerStatus

+ type WorkspaceAgentDevcontainerStatus string

+ const WorkspaceAgentDevcontainerStatusError

+ const WorkspaceAgentDevcontainerStatusRunning

+ const WorkspaceAgentDevcontainerStatusStarting

+ const WorkspaceAgentDevcontainerStatusStopped

type WorkspaceApp

+ Group string

type WorkspaceBuild

+ WorkspaceOwnerUsername string

May 20, 2025 GO-2025-3921 +20 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type WorkspaceAgent

+ ParentID uuid.NullUUID

May 15, 2025 GO-2025-3921 +20 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ var ExperimentsSafe = Experiments

+ var TerminalFontNames = []TerminalFontName

type Client

+ func (c *Client) Dial(ctx context.Context, path string, opts *websocket.DialOptions) (*websocket.Conn, error)

+ func (c *Client) GetUserAppearanceSettings(ctx context.Context, user string) (UserAppearanceSettings, error)

+ func (c *Client) TemplateVersionDynamicParameters(ctx context.Context, userID, version uuid.UUID) (*wsjson.Stream[DynamicParametersResponse, DynamicParametersRequest], error)

type CreateWorkspaceBuildRequest

+ TemplateVersionPresetID uuid.UUID

type CreateWorkspaceRequest

+ EnableDynamicParameters bool

+ TemplateVersionPresetID uuid.UUID

type DeploymentValues

+ HTTPCookies HTTPCookieConfig

+ Prebuilds PrebuildsConfig

+ WorkspaceHostnameSuffix serpent.String

+ type DynamicParametersRequest struct

+ ID int

+ Inputs map[string]string

+ type DynamicParametersResponse struct

+ Diagnostics previewtypes.Diagnostics

+ ID int

+ Parameters []previewtypes.Parameter

type Experiment

+ const ExperimentDynamicParameters

+ const ExperimentWorkspacePrebuilds

type FeatureName

+ const FeatureWorkspacePrebuilds

+ type FriendlyDiagnostic = previewtypes.FriendlyDiagnostic

+ type HTTPCookieConfig struct

+ SameSite string

+ Secure serpent.Bool

+ func (cfg *HTTPCookieConfig) Apply(c *http.Cookie) *http.Cookie

+ func (cfg HTTPCookieConfig) HTTPSameSite() http.SameSite

+ type NullHCLString = previewtypes.NullHCLString

type ParameterResolver

+ func (r *ParameterResolver) Resolve(p TemplateVersionParameter, v *WorkspaceBuildParameter) string

+ type PrebuildsConfig struct

+ ReconciliationBackoffInterval serpent.Duration

+ ReconciliationBackoffLookback serpent.Duration

+ ReconciliationInterval serpent.Duration

type SSHConfigResponse

+ HostnameSuffix string

+ type TerminalFontName string

+ const TerminalFontFiraCode

+ const TerminalFontIBMPlexMono

+ const TerminalFontJetBrainsMono

+ const TerminalFontSourceCodePro

+ const TerminalFontUnknown

type UpdateUserAppearanceSettingsRequest

+ TerminalFont TerminalFontName

type UserAppearanceSettings

+ TerminalFont TerminalFontName

type UsersRequest

+ LoginType []LoginType

type WorkspaceAgentContainer

+ func (c *WorkspaceAgentContainer) Match(idOrName string) bool

type WorkspaceAgentDevcontainer

+ Container *WorkspaceAgentContainer

+ Dirty bool

+ type WorkspaceAgentDevcontainersResponse struct

+ Devcontainers []WorkspaceAgentDevcontainer

type WorkspaceBuild

+ TemplateVersionPresetID *uuid.UUID

Apr 29, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 24, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 23, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 2, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const CoderDesktopTelemetryHeader

+ const InboxNotificationFallbackIconAccount

+ const InboxNotificationFallbackIconOther

+ const InboxNotificationFallbackIconTemplate

+ const InboxNotificationFallbackIconWorkspace

type BuildInfoResponse

+ WebPushPublicKey string

type Client

+ func (c *Client) DeleteWebpushSubscription(ctx context.Context, user string, req DeleteWebpushSubscription) error

+ func (c *Client) ListInboxNotifications(ctx context.Context, req ListInboxNotificationsRequest) (ListInboxNotificationsResponse, error)

+ func (c *Client) MarkAllInboxNotificationsAsRead(ctx context.Context) error

+ func (c *Client) PostTestWebpushMessage(ctx context.Context) error

+ func (c *Client) PostWebpushSubscription(ctx context.Context, user string, req WebpushSubscription) error

+ func (c *Client) UpdateInboxNotificationReadStatus(ctx context.Context, notifID string, ...) (UpdateInboxNotificationReadStatusResponse, error)

+ type CoderDesktopTelemetry struct

+ CoderDesktopVersion string

+ DeviceID string

+ DeviceOS string

+ func (t *CoderDesktopTelemetry) FromHeader(headerValue string) error

+ func (t *CoderDesktopTelemetry) IsEmpty() bool

+ type DeleteWebpushSubscription struct

+ Endpoint string

type Experiment

+ const ExperimentWebPush

+ type GetInboxNotificationResponse struct

+ Notification InboxNotification

+ UnreadCount int

+ type InboxNotification struct

+ Actions []InboxNotificationAction

+ Content string

+ CreatedAt time.Time

+ ID uuid.UUID

+ Icon string

+ ReadAt *time.Time

+ Targets []uuid.UUID

+ TemplateID uuid.UUID

+ Title string

+ UserID uuid.UUID

+ type InboxNotificationAction struct

+ Label string

+ URL string

+ type ListInboxNotificationsRequest struct

+ ReadStatus string

+ StartingBefore string

+ Targets string

+ Templates string

+ type ListInboxNotificationsResponse struct

+ Notifications []InboxNotification

+ UnreadCount int

type NotificationsConfig

+ Inbox NotificationsInboxConfig

+ type NotificationsInboxConfig struct

+ Enabled serpent.Bool

+ type PaginatedMembersRequest struct

+ Limit int

+ Offset int

+ type PaginatedMembersResponse struct

+ Count int

+ Members []OrganizationMemberWithUserData

type RBACResource

+ const ResourceInboxNotification

+ const ResourceWebpushSubscription

+ const ResourceWorkspaceAgentDevcontainers

type RequestOption

+ func ListInboxNotificationsRequestToQueryParams(req ListInboxNotificationsRequest) []RequestOption

+ type UpdateInboxNotificationReadStatusRequest struct

+ IsRead bool

+ type UpdateInboxNotificationReadStatusResponse struct

+ Notification InboxNotification

+ UnreadCount int

+ type UserAppearanceSettings struct

+ ThemePreference string

+ type WebpushMessage struct

+ Actions []WebpushMessageAction

+ Body string

+ Icon string

+ Title string

+ type WebpushMessageAction struct

+ Label string

+ URL string

+ type WebpushSubscription struct

+ AuthKey string

+ Endpoint string

+ P256DHKey string

type Workspace

+ LatestAppStatus *WorkspaceAppStatus

+ type WorkspaceAgentContainer struct

+ CreatedAt time.Time

+ FriendlyName string

+ ID string

+ Image string

+ Labels map[string]string

+ Ports []WorkspaceAgentContainerPort

+ Running bool

+ Status string

+ Volumes map[string]string

+ type WorkspaceAgentContainerPort struct

+ HostIP string

+ HostPort uint16

+ Network string

+ Port uint16

type WorkspaceAgentDevcontainer

+ ConfigPath string

+ Name string

+ WorkspaceFolder string

type WorkspaceApp

+ Statuses []WorkspaceAppStatus

+ type WorkspaceAppStatus struct

+ AgentID uuid.UUID

+ AppID uuid.UUID

+ CreatedAt time.Time

+ ID uuid.UUID

+ Icon string

+ Message string

+ NeedsUserAttention bool

+ State WorkspaceAppStatusState

+ URI string

+ WorkspaceID uuid.UUID

+ type WorkspaceAppStatusState string

+ const WorkspaceAppStatusStateComplete

+ const WorkspaceAppStatusStateFailure

+ const WorkspaceAppStatusStateWorking

Apr 29, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const DatabaseNotReachable

+ var ErrDatabaseNotReachable = xerrors.New(DatabaseNotReachable)

Mar 17, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 15, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 4, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LicenseTelemetryRequiredErrorText

+ const RoleOrganizationWorkspaceCreationBan

+ var ProvisionerKeyUUIDBuiltIn = uuid.MustParse(ProvisionerKeyIDBuiltIn)

+ var ProvisionerKeyUUIDPSK = uuid.MustParse(ProvisionerKeyIDPSK)

+ var ProvisionerKeyUUIDUserAuth = uuid.MustParse(ProvisionerKeyIDUserAuth)

type AuditAction

+ const AuditActionClose

+ const AuditActionConnect

+ const AuditActionDisconnect

+ const AuditActionOpen

type Client

+ func (c *Client) PostTestNotification(ctx context.Context) error

+ func (c *Client) TemplateVersionPresets(ctx context.Context, templateVersionID uuid.UUID) ([]Preset, error)

+ func (c *Client) WorkspaceAgentListContainers(ctx context.Context, agentID uuid.UUID, labels map[string]string) (WorkspaceAgentListContainersResponse, error)

type CreateTestAuditLogRequest

+ RequestID uuid.UUID

+ type GithubAuthMethod struct

+ DefaultProviderConfigured bool

+ Enabled bool

+ type OAuth2DeviceFlowCallbackResponse struct

+ RedirectURL string

type OAuth2GithubConfig

+ DefaultProviderEnable serpent.Bool

+ DeviceFlow serpent.Bool

type OIDCConfig

+ UserInfoFromAccessToken serpent.Bool

+ type OrganizationProvisionerDaemonsOptions struct

+ IDs []uuid.UUID

+ Limit int

+ Tags map[string]string

type OrganizationProvisionerJobsOptions

+ IDs []uuid.UUID

+ Tags map[string]string

+ type Preset struct

+ ID uuid.UUID

+ Name string

+ Parameters []PresetParameter

+ type PresetParameter struct

+ Name string

+ Value string

type ProvisionerDaemonJob

+ TemplateDisplayName string

+ TemplateIcon string

+ TemplateName string

type ProvisionerJob

+ Metadata ProvisionerJobMetadata

+ type ProvisionerJobMetadata struct

+ TemplateDisplayName string

+ TemplateID uuid.UUID

+ TemplateIcon string

+ TemplateName string

+ TemplateVersionName string

+ WorkspaceID *uuid.UUID

+ WorkspaceName string

type RBACAction

+ const ActionUnassign

type RBACResource

+ const ResourceWorkspaceAgentResourceMonitor

type ResourceType

+ const ResourceTypeWorkspaceAgent

+ const ResourceTypeWorkspaceApp

+ type WorkspaceAgentDevcontainer struct

+ CreatedAt time.Time

+ FriendlyName string

+ ID string

+ Image string

+ Labels map[string]string

+ Ports []WorkspaceAgentListeningPort

+ Running bool

+ Status string

+ Volumes map[string]string

+ type WorkspaceAgentListContainersResponse struct

+ Containers []WorkspaceAgentDevcontainer

+ Warnings []string

Apr 29, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 23, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 6, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 4, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ var MapWorkspaceAppOpenIns = map[WorkspaceAppOpenIn]struct

type Client

+ func (c *Client) GetIDPSyncFieldValues(ctx context.Context, claimField string) ([]string, error)

+ func (c *Client) GetOrganizationIDPSyncFieldValues(ctx context.Context, orgID string, claimField string) ([]string, error)

+ func (c *Client) GetUserStatusCounts(ctx context.Context, req GetUserStatusCountsRequest) (GetUserStatusCountsResponse, error)

+ func (c *Client) OrganizationProvisionerJob(ctx context.Context, organizationID, jobID uuid.UUID) (job ProvisionerJob, err error)

+ func (c *Client) OrganizationProvisionerJobs(ctx context.Context, organizationID uuid.UUID, ...) ([]ProvisionerJob, error)

+ func (c *Client) PatchGroupIDPSyncConfig(ctx context.Context, orgID string, req PatchGroupIDPSyncConfigRequest) (GroupSyncSettings, error)

+ func (c *Client) PatchGroupIDPSyncMapping(ctx context.Context, orgID string, req PatchGroupIDPSyncMappingRequest) (GroupSyncSettings, error)

+ func (c *Client) PatchOrganizationIDPSyncConfig(ctx context.Context, req PatchOrganizationIDPSyncConfigRequest) (OrganizationSyncSettings, error)

+ func (c *Client) PatchOrganizationIDPSyncMapping(ctx context.Context, req PatchOrganizationIDPSyncMappingRequest) (OrganizationSyncSettings, error)

+ func (c *Client) PatchRoleIDPSyncConfig(ctx context.Context, orgID string, req PatchRoleIDPSyncConfigRequest) (RoleSyncSettings, error)

+ func (c *Client) PatchRoleIDPSyncMapping(ctx context.Context, orgID string, req PatchRoleIDPSyncMappingRequest) (RoleSyncSettings, error)

type DeploymentValues

+ EphemeralDeployment serpent.Bool

+ type GetUserStatusCountsRequest struct

+ Offset time.Time

+ type GetUserStatusCountsResponse struct

+ StatusCounts map[UserStatus][]UserStatusChangeCount

+ type IDPSyncMapping struct

+ Gets ResourceIdType

+ Given string

type NotificationTemplate

+ EnabledByDefault bool

+ type OrganizationProvisionerJobsOptions struct

+ Limit int

+ Status []ProvisionerJobStatus

+ type PatchGroupIDPSyncConfigRequest struct

+ AutoCreateMissing bool

+ Field string

+ RegexFilter *regexp.Regexp

+ type PatchGroupIDPSyncMappingRequest struct

+ Add []IDPSyncMapping[uuid.UUID]

+ Remove []IDPSyncMapping[uuid.UUID]

+ type PatchOrganizationIDPSyncConfigRequest struct

+ AssignDefault bool

+ Field string

+ type PatchOrganizationIDPSyncMappingRequest struct

+ Add []IDPSyncMapping[uuid.UUID]

+ Remove []IDPSyncMapping[uuid.UUID]

+ type PatchRoleIDPSyncConfigRequest struct

+ Field string

+ type PatchRoleIDPSyncMappingRequest struct

+ Add []IDPSyncMapping[string]

+ Remove []IDPSyncMapping[string]

type ProvisionerDaemon

+ CurrentJob *ProvisionerDaemonJob

+ KeyName *string

+ PreviousJob *ProvisionerDaemonJob

+ Status *ProvisionerDaemonStatus

+ type ProvisionerDaemonJob struct

+ ID uuid.UUID

+ Status ProvisionerJobStatus

+ type ProvisionerDaemonStatus string

+ const ProvisionerDaemonBusy

+ const ProvisionerDaemonIdle

+ const ProvisionerDaemonOffline

type ProvisionerJob

+ AvailableWorkers []uuid.UUID

+ Input ProvisionerJobInput

+ OrganizationID uuid.UUID

+ Type ProvisionerJobType

+ type ProvisionerJobInput struct

+ Error string

+ TemplateVersionID *uuid.UUID

+ WorkspaceBuildID *uuid.UUID

type ProvisionerJobStatus

+ func ProvisionerJobStatusEnums() []ProvisionerJobStatus

+ type ProvisionerJobType string

+ const ProvisionerJobTypeTemplateVersionDryRun

+ const ProvisionerJobTypeTemplateVersionImport

+ const ProvisionerJobTypeWorkspaceBuild

type RBACResource

+ const ResourceProvisionerJobs

type ResourceType

+ const ResourceTypeIdpSyncSettingsGroup

+ const ResourceTypeIdpSyncSettingsOrganization

+ const ResourceTypeIdpSyncSettingsRole

+ type UserStatusChangeCount struct

+ Count int64

+ Date time.Time

type Workspace

+ NextStartAt *time.Time

type WorkspaceApp

+ OpenIn WorkspaceAppOpenIn

+ type WorkspaceAppOpenIn string

+ const WorkspaceAppOpenInSlimWindow

+ const WorkspaceAppOpenInTab

Jan 29, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 23, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 18, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 7, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 16, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type Client

+ func (c *Client) TemplateVersionDryRunMatchedProvisioners(ctx context.Context, version, job uuid.UUID) (MatchedProvisioners, error)

type WorkspaceBuild

+ MatchedProvisioners *MatchedProvisioners

Dec 3, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ var Countries = []Country

+ type AgentConnectionTiming struct

+ EndedAt time.Time

+ Stage TimingStage

+ StartedAt time.Time

+ WorkspaceAgentID string

+ WorkspaceAgentName string

type AgentScriptTiming

+ WorkspaceAgentID string

+ WorkspaceAgentName string

type Client

+ func (c *Client) GetAvailableIDPSyncFields(ctx context.Context) ([]string, error)

+ func (c *Client) GetOrganizationAvailableIDPSyncFields(ctx context.Context, orgID string) ([]string, error)

+ func (c *Client) GetProvisionerKey(ctx context.Context, pk string) (ProvisionerKey, error)

+ func (c *Client) OrganizationIDPSyncSettings(ctx context.Context) (OrganizationSyncSettings, error)

+ func (c *Client) PatchOrganizationIDPSyncSettings(ctx context.Context, req OrganizationSyncSettings) (OrganizationSyncSettings, error)

+ func (c *Client) ValidateUserPassword(ctx context.Context, req ValidateUserPasswordRequest) (ValidateUserPasswordResponse, error)

+ type Country struct

+ Flag string

+ Name string

type DeploymentValues

+ AdditionalCSPPolicy serpent.StringArray

+ type MatchedProvisioners struct

+ Available int

+ Count int

+ MostRecentlySeen NullTime

type NotificationsConfig

+ func (n *NotificationsConfig) Enabled() bool

+ type OrganizationSyncSettings struct

+ AssignDefault bool

+ Field string

+ Mapping map[string][]uuid.UUID

type RBACResource

+ const ResourceNotificationMessage

type TemplateVersion

+ MatchedProvisioners MatchedProvisioners

+ type TimingStage string

+ const TimingStageApply

+ const TimingStageConnect

+ const TimingStageCron

+ const TimingStageGraph

+ const TimingStageInit

+ const TimingStagePlan

+ const TimingStageStart

+ const TimingStageStop

+ type ValidateUserPasswordRequest struct

+ Password string

+ type ValidateUserPasswordResponse struct

+ Details string

+ Valid bool

type WorkspaceBuildTimings

+ AgentConnectionTimings []AgentConnectionTiming

type WorkspaceStatus

+ func ConvertWorkspaceStatus(jobStatus ProvisionerJobStatus, transition WorkspaceTransition) WorkspaceStatus

Dec 12, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 8, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 8, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 4, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type AgentScriptTiming struct

+ DisplayName string

+ EndedAt time.Time

+ ExitCode int32

+ Stage string

+ StartedAt time.Time

+ Status string

type AuditAction

+ const AuditActionRequestPasswordReset

+ type ChangePasswordWithOneTimePasscodeRequest struct

+ Email string

+ OneTimePasscode string

+ Password string

type Client

+ func (c *Client) ChangePasswordWithOneTimePasscode(ctx context.Context, req ChangePasswordWithOneTimePasscodeRequest) error

+ func (c *Client) RequestOneTimePasscode(ctx context.Context, req RequestOneTimePasscodeRequest) error

+ func (c *Client) WorkspaceBuildTimings(ctx context.Context, build uuid.UUID) (WorkspaceBuildTimings, error)

type CreateUserRequestWithOrgs

+ UserStatus *UserStatus

+ type CryptoKey struct

+ DeletesAt time.Time

+ Feature CryptoKeyFeature

+ Secret string

+ Sequence int32

+ StartsAt time.Time

+ func (c CryptoKey) CanSign(now time.Time) bool

+ func (c CryptoKey) CanVerify(now time.Time) bool

+ type CryptoKeyFeature string

+ const CryptoKeyFeatureOIDCConvert

+ const CryptoKeyFeatureTailnetResume

+ const CryptoKeyFeatureWorkspaceAppsAPIKey

+ const CryptoKeyFeatureWorkspaceAppsToken

+ type RequestOneTimePasscodeRequest struct

+ Email string

+ type WorkspaceBuildTimings struct

+ AgentScriptTimings []AgentScriptTiming

+ ProvisionerTimings []ProvisionerTiming

Oct 24, 2024 GO-2025-3921 +18 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 1, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const ProvisionerKeyIDBuiltIn

+ const ProvisionerKeyIDPSK

+ const ProvisionerKeyIDUserAuth

+ const ProvisionerKeyNameBuiltIn

+ const ProvisionerKeyNamePSK

+ const ProvisionerKeyNameUserAuth

+ var UsernameValidRegex = regexp.MustCompile("^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$")

+ func DefaultDocsURL() string

+ func DisplayNameValid(str string) error

+ func GroupNameValid(str string) error

+ func NameValid(str string) error

+ func NormalizeRealUsername(str string) string

+ func ReservedProvisionerKeyNames() []string

+ func TemplateVersionNameValid(str string) error

+ func UserRealNameValid(str string) error

+ func UsernameFrom(str string) string

type AppearanceConfig

+ DocsURL string

type Client

+ func (c *Client) GroupIDPSyncSettings(ctx context.Context, orgID string) (GroupSyncSettings, error)

+ func (c *Client) ListProvisionerKeyDaemons(ctx context.Context, organizationID uuid.UUID) ([]ProvisionerKeyDaemons, error)

+ func (c *Client) PatchGroupIDPSyncSettings(ctx context.Context, orgID string, req GroupSyncSettings) (GroupSyncSettings, error)

+ func (c *Client) PatchRoleIDPSyncSettings(ctx context.Context, orgID string, req RoleSyncSettings) (RoleSyncSettings, error)

+ func (c *Client) RoleIDPSyncSettings(ctx context.Context, orgID string) (RoleSyncSettings, error)

+ func (c *Client) WorkspaceTimings(ctx context.Context, id uuid.UUID) (WorkspaceTimings, error)

type GroupArguments

+ GroupIDs []uuid.UUID

+ type GroupSyncSettings struct

+ AutoCreateMissing bool

+ Field string

+ LegacyNameMapping map[string]string

+ Mapping map[string][]uuid.UUID

+ RegexFilter *regexp.Regexp

type LinkConfig

+ func DefaultSupportLinks(docsURL string) []LinkConfig

type ProvisionerDaemon

+ KeyID uuid.UUID

+ type ProvisionerKeyDaemons struct

+ Daemons []ProvisionerDaemon

+ Key ProvisionerKey

+ type ProvisionerKeyTags map[string]string

+ func (p ProvisionerKeyTags) String() string

+ type ProvisionerTiming struct

+ Action string

+ EndedAt time.Time

+ JobID uuid.UUID

+ Resource string

+ Source string

+ Stage string

+ StartedAt time.Time

type RBACResource

+ const ResourceCryptoKey

+ const ResourceIdpsyncSettings

+ type RoleSyncSettings struct

+ Field string

+ Mapping map[string][]string

type SessionLifetime

+ DefaultTokenDuration serpent.Duration

type WorkspaceAgentScript

+ DisplayName string

+ ID uuid.UUID

type WorkspaceApp

+ Hidden bool

+ type WorkspaceTimings struct

+ ProvisionerTimings []ProvisionerTiming

Oct 28, 2024 GO-2025-3921 +18 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 8, 2024 GO-2025-3921 +18 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 8, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 1, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 3, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ var AllDaysOfWeek = []string

type BuildInfoResponse

+ ProvisionerAPIVersion string

type Client

+ func (c *Client) CreateOrganizationRole(ctx context.Context, role Role) (Role, error)

+ func (c *Client) CreateUserWithOrgs(ctx context.Context, req CreateUserRequestWithOrgs) (User, error)

+ func (c *Client) DeleteOrganizationRole(ctx context.Context, organizationID uuid.UUID, roleName string) error

+ func (c *Client) GetNotificationDispatchMethods(ctx context.Context) (NotificationMethodsResponse, error)

+ func (c *Client) GetSystemNotificationTemplates(ctx context.Context) ([]NotificationTemplate, error)

+ func (c *Client) GetUserNotificationPreferences(ctx context.Context, userID uuid.UUID) ([]NotificationPreference, error)

+ func (c *Client) Groups(ctx context.Context, args GroupArguments) ([]Group, error)

+ func (c *Client) StarterTemplates(ctx context.Context) ([]TemplateExample, error)

+ func (c *Client) UpdateNotificationTemplateMethod(ctx context.Context, notificationTemplateID uuid.UUID, method string) error

+ func (c *Client) UpdateOrganizationRole(ctx context.Context, role Role) (Role, error)

+ func (c *Client) UpdateUserNotificationPreferences(ctx context.Context, userID uuid.UUID, req UpdateUserNotificationPreferences) ([]NotificationPreference, error)

type CreateTemplateRequest

+ MaxPortShareLevel *WorkspaceAgentPortShareLevel

+ type CreateUserRequestWithOrgs struct

+ Email string

+ Name string

+ OrganizationIDs []uuid.UUID

+ Password string

+ UserLoginType LoginType

+ Username string

+ func (r *CreateUserRequestWithOrgs) UnmarshalJSON(data []byte) error

+ type CustomRoleRequest struct

+ DisplayName string

+ Name string

+ OrganizationPermissions []Permission

+ SitePermissions []Permission

+ UserPermissions []Permission

type Entitlement

+ func (e Entitlement) Entitled() bool

type FeatureName

+ func (n FeatureName) Enterprise() bool

type Group

+ OrganizationDisplayName string

+ OrganizationName string

+ TotalMemberCount int

+ type GroupArguments struct

+ HasMember string

+ Organization string

+ type NotificationMethodsResponse struct

+ AvailableNotificationMethods []string

+ DefaultNotificationMethod string

+ type NotificationPreference struct

+ Disabled bool

+ NotificationTemplateID uuid.UUID

+ UpdatedAt time.Time

+ type NotificationTemplate struct

+ Actions string

+ BodyTemplate string

+ Group string

+ ID uuid.UUID

+ Kind string

+ Method string

+ Name string

+ TitleTemplate string

type OIDCConfig

+ OrganizationAssignDefault serpent.Bool

+ OrganizationField serpent.String

+ OrganizationMapping serpent.Struct[map[string][]uuid.UUID]

type RBACResource

+ const ResourceGroupMember

+ const ResourceNotificationPreference

+ const ResourceNotificationTemplate

type ResourceType

+ const ResourceTypeNotificationTemplate

type TemplateFilter

+ FuzzyName string

+ SearchQuery string

+ type UpdateNotificationTemplateMethod struct

+ Method string

+ type UpdateUserNotificationPreferences struct

+ TemplateDisabledMap map[string]bool

Oct 24, 2024 GO-2025-3921 +18 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 5, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 20, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 7, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 6, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const ProvisionerDaemonKey

+ const RoleOrganizationAuditor

+ const RoleOrganizationTemplateAdmin

+ const RoleOrganizationUserAdmin

+ func DiscoverVarsFiles(workDir string) ([]string, error)

type AuditLog

+ Organization *MinimalOrganization

type AuthorizationObject

+ AnyOrgOwner bool

type Client

+ func (c *Client) CreateProvisionerKey(ctx context.Context, organizationID uuid.UUID, req CreateProvisionerKeyRequest) (CreateProvisionerKeyResponse, error)

+ func (c *Client) CreateUserWorkspace(ctx context.Context, user string, request CreateWorkspaceRequest) (Workspace, error)

+ func (c *Client) DeleteProvisionerKey(ctx context.Context, organizationID uuid.UUID, name string) error

+ func (c *Client) GetNotificationsSettings(ctx context.Context) (NotificationsSettings, error)

+ func (c *Client) ListProvisionerKeys(ctx context.Context, organizationID uuid.UUID) ([]ProvisionerKey, error)

+ func (c *Client) OrganizationProvisionerDaemons(ctx context.Context, organizationID uuid.UUID) ([]ProvisionerDaemon, error)

+ func (c *Client) Organizations(ctx context.Context) ([]Organization, error)

+ func (c *Client) PutNotificationsSettings(ctx context.Context, settings NotificationsSettings) error

+ type CreateProvisionerKeyRequest struct

+ Name string

+ Tags map[string]string

+ type CreateProvisionerKeyResponse struct

+ Key string

type DeploymentValues

+ Notifications NotificationsConfig

type Entitlement

+ func (e Entitlement) Weight() int

type Entitlements

+ func (e *Entitlements) AddFeature(name FeatureName, add Feature)

type Experiment

+ const ExperimentNotifications

type ExternalAuthUser

+ ID int64

type Feature

+ func (f Feature) Capable() bool

+ func (f Feature) Compare(b Feature) int

type FeatureName

+ const FeatureMultipleOrganizations

+ type FeatureSet string

+ const FeatureSetEnterprise

+ const FeatureSetNone

+ const FeatureSetPremium

+ func (set FeatureSet) Features() []FeatureName

+ type MinimalOrganization struct

+ DisplayName string

+ ID uuid.UUID

+ Icon string

+ Name string

+ type NotificationsConfig struct

+ DispatchTimeout serpent.Duration

+ FetchInterval serpent.Duration

+ LeaseCount serpent.Int64

+ LeasePeriod serpent.Duration

+ MaxSendAttempts serpent.Int64

+ Method serpent.String

+ RetryInterval serpent.Duration

+ SMTP NotificationsEmailConfig

+ StoreSyncBufferSize serpent.Int64

+ StoreSyncInterval serpent.Duration

+ Webhook NotificationsWebhookConfig

+ type NotificationsEmailAuthConfig struct

+ Identity serpent.String

+ Password serpent.String

+ PasswordFile serpent.String

+ Username serpent.String

+ func (c *NotificationsEmailAuthConfig) Empty() bool

+ type NotificationsEmailConfig struct

+ Auth NotificationsEmailAuthConfig

+ ForceTLS serpent.Bool

+ From serpent.String

+ Hello serpent.String

+ Smarthost serpent.HostPort

+ TLS NotificationsEmailTLSConfig

+ type NotificationsEmailTLSConfig struct

+ CAFile serpent.String

+ CertFile serpent.String

+ InsecureSkipVerify serpent.Bool

+ KeyFile serpent.String

+ ServerName serpent.String

+ StartTLS serpent.Bool

+ func (c *NotificationsEmailTLSConfig) Empty() bool

+ type NotificationsSettings struct

+ NotifierPaused bool

+ type NotificationsWebhookConfig struct

+ Endpoint serpent.URL

type OIDCConfig

+ SkipIssuerChecks serpent.Bool

+ type OrganizationMemberWithUserData struct

+ AvatarURL string

+ Email string

+ GlobalRoles []SlimRole

+ Name string

+ Username string

+ type PatchRoleRequest struct

+ DisplayName string

+ Name string

+ OrganizationPermissions []Permission

+ SitePermissions []Permission

+ UserPermissions []Permission

type ProvisionerDaemon

+ OrganizationID uuid.UUID

+ type ProvisionerKey struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Name string

+ OrganizationID uuid.UUID

+ Tags map[string]string

type RBACResource

+ const ResourceProvisionerKeys

type ReducedUser

+ UpdatedAt time.Time

type ResourceType

+ const ResourceTypeNotificationsSettings

type ServeProvisionerDaemonRequest

+ ProvisionerKey string

type Template

+ OrganizationDisplayName string

+ OrganizationIcon string

+ OrganizationName string

+ type TemplateFilter struct

+ ExactName string

+ OrganizationID uuid.UUID

type VariableValue

+ func ParseUserVariableValues(varsFiles []string, variablesFile string, commandLineVariables []string) ([]VariableValue, error)

type Workspace

+ OrganizationName string

Aug 20, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 6, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 1, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 23, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 18, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 2, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const RoleAuditor

+ const RoleMember

+ const RoleOrganizationAdmin

+ const RoleOrganizationMember

+ const RoleOwner

+ const RoleTemplateAdmin

+ const RoleUserAdmin

+ var AllowedAppNames = []UsageAppName

+ var RBACResourceActions = map[RBACResource][]RBACAction

type Client

+ func (c *Client) DeleteOrganizationMember(ctx context.Context, organizationID uuid.UUID, user string) error

+ func (c *Client) OrganizationMembers(ctx context.Context, organizationID uuid.UUID) ([]OrganizationMemberWithName, error)

+ func (c *Client) PostOrganizationMember(ctx context.Context, organizationID uuid.UUID, user string) (OrganizationMember, error)

+ func (c *Client) PostWorkspaceUsageWithBody(ctx context.Context, id uuid.UUID, req PostWorkspaceUsageRequest) error

+ func (c *Client) Templates(ctx context.Context) ([]Template, error)

+ func (c *Client) UpdateWorkspaceUsageWithBodyContext(ctx context.Context, workspaceID uuid.UUID, req PostWorkspaceUsageRequest) func()

type CreateFirstUserRequest

+ Name string

type CreateOrganizationRequest

+ Description string

+ DisplayName string

+ Icon string

type CreateTestAuditLogRequest

+ OrganizationID uuid.UUID

type CreateUserRequest

+ Name string

type Experiment

+ const ExperimentWorkspaceUsage

type OIDCConfig

+ NameField serpent.String

type Organization

+ Description string

+ DisplayName string

+ Icon string

+ func (o Organization) HumanName() string

+ type OrganizationMemberWithName struct

+ Username string

+ type PostWorkspaceUsageRequest struct

+ AgentID uuid.UUID

+ AppName UsageAppName

type ResourceType

+ const ResourceTypeCustomRole

+ const ResourceTypeOrganizationMember

type SlimRole

+ OrganizationID string

+ func (s SlimRole) String() string

+ func (s SlimRole) UniqueName() string

type UpdateOrganizationRequest

+ Description *string

+ DisplayName string

+ Icon *string

+ type UsageAppName string

+ const UsageAppNameJetbrains

+ const UsageAppNameReconnectingPty

+ const UsageAppNameSSH

+ const UsageAppNameVscode

Aug 1, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 18, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 24, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 21, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 6, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 4, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AppearanceConfig

+ AnnouncementBanners []BannerConfig

type AssignableRoles

+ BuiltIn bool

+ type BannerConfig struct

+ BackgroundColor string

+ Enabled bool

+ Message string

type Client

+ func (c *Client) DeleteOrganization(ctx context.Context, orgID string) error

+ func (c *Client) PatchOrganizationRole(ctx context.Context, organizationID uuid.UUID, req Role) (Role, error)

+ func (c *Client) UpdateOrganization(ctx context.Context, orgID string, req UpdateOrganizationRequest) (Organization, error)

type Experiment

+ const ExperimentCustomRoles

+ const ExperimentMultiOrganization

type FeatureName

+ const FeatureCustomRoles

+ type Permission struct

+ Action RBACAction

+ Negate bool

+ ResourceType RBACResource

+ func CreatePermissions(mapping map[RBACResource][]RBACAction) []Permission

+ type RBACAction string

+ const ActionApplicationConnect

+ const ActionAssign

+ const ActionReadPersonal

+ const ActionSSH

+ const ActionUpdatePersonal

+ const ActionUse

+ const ActionViewInsights

+ const ActionWorkspaceStart

+ const ActionWorkspaceStop

type RBACResource

+ const ResourceApiKey

+ const ResourceAssignOrgRole

+ const ResourceAssignRole

+ const ResourceDeploymentConfig

+ const ResourceOauth2App

+ const ResourceOauth2AppCodeToken

+ const ResourceOauth2AppSecret

+ const ResourceTailnetCoordinator

+ const ResourceWildcard

+ const ResourceWorkspaceDormant

type Role

+ OrganizationID string

+ OrganizationPermissions []Permission

+ SitePermissions []Permission

+ UserPermissions []Permission

+ func (r Role) FullName() string

+ type SlimRole struct

+ DisplayName string

+ Name string

type TemplateAppUsage

+ TimesUsed int64

type UpdateAppearanceConfig

+ AnnouncementBanners []BannerConfig

+ type UpdateOrganizationRequest struct

+ Name string

Jun 24, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 21, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type BuildInfoResponse

+ Telemetry bool

May 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 16, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 6, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ func ProvisionerTypeValid[T ProvisionerType | string](pt T) error

type AuthMethods

+ TermsOfServiceURL string

type BuildInfoResponse

+ DeploymentID string

type DeploymentValues

+ Sessions SessionLifetime

+ TermsOfServiceURL serpent.String

type ProvisionerConfig

+ DaemonTypes serpent.StringArray

+ type SessionLifetime struct

+ DefaultDuration serpent.Duration

+ DisableExpiryRefresh serpent.Bool

+ MaximumTokenDuration serpent.Duration

May 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 17, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 3, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const EntitlementsWarningHeader

+ const TemplateBuiltinAppDisplayNameSFTP

+ var PostgresAuthDrivers = []string

type Client

+ func (c *Client) PostWorkspaceUsage(ctx context.Context, id uuid.UUID) error

+ func (c *Client) UpdateWorkspaceUsageContext(ctx context.Context, id uuid.UUID) func()

type DeploymentValues

+ PostgresAuth string

+ type PostgresAuth string

+ const PostgresAuthAWSIAMRDS

+ const PostgresAuthPassword

type PrometheusConfig

+ AggregateAgentStatsBy serpent.StringArray

Apr 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 17, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 5, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 19, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 12, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const WorkspaceAgentPortShareLevelAuthenticated

+ const WorkspaceAgentPortShareLevelOwner

+ const WorkspaceAgentPortShareLevelPublic

+ const WorkspaceAgentPortShareProtocolHTTP

+ const WorkspaceAgentPortShareProtocolHTTPS

+ var DefaultOrganization = "default"

+ func WebsocketNetConn(ctx context.Context, conn *websocket.Conn, msgType websocket.MessageType) (context.Context, net.Conn)

+ type AccessURLReport struct

+ AccessURL string

+ Dismissed bool

+ Error *string

+ Healthy bool

+ HealthzResponse string

+ Reachable bool

+ Severity health.Severity

+ StatusCode int

+ Warnings []health.Message

type Client

+ func (c *Client) DebugHealth(ctx context.Context) (HealthcheckReport, error)

+ func (c *Client) DeleteWorkspaceAgentPortShare(ctx context.Context, workspaceID uuid.UUID, ...) error

+ func (c *Client) GetWorkspaceAgentPortShares(ctx context.Context, workspaceID uuid.UUID) (WorkspaceAgentPortShares, error)

+ func (c *Client) OrganizationByUserAndName(ctx context.Context, user string, name string) (Organization, error)

+ func (c *Client) RevokeOAuth2ProviderApp(ctx context.Context, appID uuid.UUID) error

+ func (c *Client) UpsertWorkspaceAgentPortShare(ctx context.Context, workspaceID uuid.UUID, ...) (WorkspaceAgentPortShare, error)

type CreateTemplateRequest

+ ActivityBumpMillis *int64

+ type DERPHealthReport struct

+ Dismissed bool

+ Error *string

+ Healthy bool

+ Netcheck *netcheck.Report

+ NetcheckErr *string

+ NetcheckLogs []string

+ Regions map[int]*DERPRegionReport

+ Severity health.Severity

+ Warnings []health.Message

+ type DERPNodeReport struct

+ CanExchangeMessages bool

+ ClientErrs [][]string

+ ClientLogs [][]string

+ Error *string

+ Healthy bool

+ Node *tailcfg.DERPNode

+ RoundTripPing string

+ RoundTripPingMs int

+ STUN STUNReport

+ ServerInfo derp.ServerInfoMessage

+ Severity health.Severity

+ UsesWebsocket bool

+ Warnings []health.Message

+ type DERPRegionReport struct

+ Error *string

+ Healthy bool

+ NodeReports []*DERPNodeReport

+ Region *tailcfg.DERPRegion

+ Severity health.Severity

+ Warnings []health.Message

+ type DatabaseReport struct

+ Dismissed bool

+ Error *string

+ Healthy bool

+ Latency string

+ LatencyMS int64

+ Reachable bool

+ Severity health.Severity

+ ThresholdMS int64

+ Warnings []health.Message

+ type DeleteWorkspaceAgentPortShareRequest struct

+ AgentName string

+ Port int32

type EnhancedExternalAuthProvider

+ const EnhancedExternalAuthProviderAzureDevopsEntra

+ const EnhancedExternalAuthProviderGitea

type Experiment

+ const ExperimentAutoFillParameters

+ const ExperimentSharedPorts

type FeatureName

+ const FeatureControlSharedPorts

+ type HealthcheckReport struct

+ AccessURL AccessURLReport

+ CoderVersion string

+ DERP DERPHealthReport

+ Database DatabaseReport

+ FailingSections []HealthSection

+ Healthy bool

+ ProvisionerDaemons ProvisionerDaemonsReport

+ Severity health.Severity

+ Time time.Time

+ Websocket WebsocketReport

+ WorkspaceProxy WorkspaceProxyReport

+ type OAuth2ProviderAppFilter struct

+ UserID uuid.UUID

+ type OAuth2ProviderGrantType string

+ const OAuth2ProviderGrantTypeAuthorizationCode

+ const OAuth2ProviderGrantTypeRefreshToken

+ func (e OAuth2ProviderGrantType) Valid() bool

+ type OAuth2ProviderResponseType string

+ const OAuth2ProviderResponseTypeCode

+ func (e OAuth2ProviderResponseType) Valid() bool

type Organization

+ IsDefault bool

+ type ProvisionerDaemonsReport struct

+ Dismissed bool

+ Error *string

+ Items []ProvisionerDaemonsReportItem

+ Severity health.Severity

+ Warnings []health.Message

+ type ProvisionerDaemonsReportItem struct

+ Warnings []health.Message

+ type ReducedUser struct

+ CreatedAt time.Time

+ Email string

+ LastSeenAt time.Time

+ LoginType LoginType

+ Name string

+ Status UserStatus

+ ThemePreference string

type ResourceType

+ const ResourceTypeOAuth2ProviderApp

+ const ResourceTypeOAuth2ProviderAppSecret

+ type STUNReport struct

+ CanSTUN bool

+ Enabled bool

+ Error *string

type Template

+ ActivityBumpMillis int64

+ MaxPortShareLevel WorkspaceAgentPortShareLevel

type TemplateVersionExternalAuth

+ Optional bool

type UpdateTemplateMeta

+ ActivityBumpMillis int64

+ MaxPortShareLevel *WorkspaceAgentPortShareLevel

+ type UpsertWorkspaceAgentPortShareRequest struct

+ AgentName string

+ Port int32

+ Protocol WorkspaceAgentPortShareProtocol

+ ShareLevel WorkspaceAgentPortShareLevel

+ type WebsocketReport struct

+ Body string

+ Code int

+ Dismissed bool

+ Error *string

+ Healthy bool

+ Severity health.Severity

+ Warnings []string

type WorkspaceAgentConn

+ func (c *WorkspaceAgentConn) GetPeerDiagnostics() tailnet.PeerDiagnostics

+ type WorkspaceAgentPortShare struct

+ AgentName string

+ Port int32

+ Protocol WorkspaceAgentPortShareProtocol

+ ShareLevel WorkspaceAgentPortShareLevel

+ WorkspaceID uuid.UUID

+ type WorkspaceAgentPortShareLevel string

+ func (l WorkspaceAgentPortShareLevel) ValidMaxLevel() bool

+ func (l WorkspaceAgentPortShareLevel) ValidPortShareLevel() bool

+ type WorkspaceAgentPortShareProtocol string

+ func (p WorkspaceAgentPortShareProtocol) ValidPortProtocol() bool

+ type WorkspaceAgentPortShares struct

+ Shares []WorkspaceAgentPortShare

+ type WorkspaceProxyReport struct

+ Dismissed bool

+ Error *string

+ Healthy bool

+ Severity health.Severity

+ Warnings []health.Message

+ WorkspaceProxies RegionsResponse[WorkspaceProxy]

Mar 9, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 4, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 15, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 12, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 7, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 7, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const ContentTypeZip

+ const FormatZip

+ func TimezoneOffsetHourWithTime(now time.Time, loc *time.Location) int

type BuildInfoResponse

+ UpgradeMessage string

type Client

+ func (c *Client) DownloadWithFormat(ctx context.Context, id uuid.UUID, format string) ([]byte, string, error)

+ func (c *Client) FavoriteWorkspace(ctx context.Context, workspaceID uuid.UUID) error

+ func (c *Client) JFrogXRayScan(ctx context.Context, workspaceID, agentID uuid.UUID) (JFrogXrayScan, error)

+ func (c *Client) PostJFrogXrayScan(ctx context.Context, req JFrogXrayScan) error

+ func (c *Client) UnfavoriteWorkspace(ctx context.Context, workspaceID uuid.UUID) error

+ func (c *Client) UserAutofillParameters(ctx context.Context, user string, templateID uuid.UUID) ([]UserParameter, error)

type DeploymentValues

+ CLIUpgradeMessage clibase.String

+ type JFrogXrayScan struct

+ AgentID uuid.UUID

+ Critical int

+ High int

+ Medium int

+ ResultsURL string

+ WorkspaceID uuid.UUID

+ type OAuth2AppEndpoints struct

+ Authorization string

+ DeviceAuth string

+ Token string

type OAuth2ProviderApp

+ Endpoints OAuth2AppEndpoints

type OIDCConfig

+ SignupsDisabledText clibase.String

type RBACResource

+ const ResourceUserWorkspaceBuildParameters

+ type UserParameter struct

+ Name string

+ Value string

type Workspace

+ Favorite bool

+ OwnerAvatarURL string

type WorkspaceBuild

+ WorkspaceOwnerAvatarURL string

Mar 4, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 24, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 22, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 19, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const BuildVersionHeader

+ func ExpectJSONMime(res *http.Response) error

type CreateFirstUserRequest

+ TrialInfo CreateFirstUserTrialInfo

+ type CreateFirstUserTrialInfo struct

+ CompanyName string

+ Country string

+ Developers string

+ FirstName string

+ JobTitle string

+ LastName string

+ PhoneNumber string

type Experiment

+ const ExperimentExample

type HealthSection

+ const HealthSectionProvisionerDaemons

+ type LicensorTrialRequest struct

+ CompanyName string

+ Country string

+ DeploymentID string

+ Developers string

+ Email string

+ FirstName string

+ JobTitle string

+ LastName string

+ PhoneNumber string

+ Source string

type ProvisionerDaemon

+ APIVersion string

type UpdateTemplateMeta

+ DisableEveryoneGroupAccess bool

type UpdateUserProfileRequest

+ Name string

type User

+ Name string

Mar 4, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 21, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ var MapWorkspaceAppHealths = map[WorkspaceAppHealth]struct

+ var MapWorkspaceAppSharingLevels = map[WorkspaceAppSharingLevel]struct

type Client

+ func (c *Client) DeleteOAuth2ProviderApp(ctx context.Context, id uuid.UUID) error

+ func (c *Client) DeleteOAuth2ProviderAppSecret(ctx context.Context, appID uuid.UUID, secretID uuid.UUID) error

+ func (c *Client) OAuth2ProviderApp(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error)

+ func (c *Client) OAuth2ProviderAppSecrets(ctx context.Context, appID uuid.UUID) ([]OAuth2ProviderAppSecret, error)

+ func (c *Client) OAuth2ProviderApps(ctx context.Context) ([]OAuth2ProviderApp, error)

+ func (c *Client) PostOAuth2ProviderApp(ctx context.Context, app PostOAuth2ProviderAppRequest) (OAuth2ProviderApp, error)

+ func (c *Client) PostOAuth2ProviderAppSecret(ctx context.Context, appID uuid.UUID) (OAuth2ProviderAppSecretFull, error)

+ func (c *Client) PutOAuth2ProviderApp(ctx context.Context, id uuid.UUID, app PutOAuth2ProviderAppRequest) (OAuth2ProviderApp, error)

type DeploymentValues

+ AllowWorkspaceRenames clibase.Bool

type FeatureName

+ const FeatureOAuth2Provider

+ type OAuth2ProviderApp struct

+ CallbackURL string

+ ID uuid.UUID

+ Icon string

+ Name string

+ type OAuth2ProviderAppSecret struct

+ ClientSecretTruncated string

+ ID uuid.UUID

+ LastUsedAt NullTime

+ type OAuth2ProviderAppSecretFull struct

+ ClientSecretFull string

+ ID uuid.UUID

+ type PostOAuth2ProviderAppRequest struct

+ CallbackURL string

+ Icon string

+ Name string

+ type PutOAuth2ProviderAppRequest struct

+ CallbackURL string

+ Icon string

+ Name string

type Template

+ UseMaxTTL bool

type UserQuietHoursScheduleConfig

+ AllowUserCustom clibase.Bool

type UserQuietHoursScheduleResponse

+ UserCanSet bool

type Workspace

+ AllowRenames bool

Dec 14, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type Client

+ func (c *Client) UpdateUserAppearanceSettings(ctx context.Context, user string, req UpdateUserAppearanceSettingsRequest) (User, error)

+ type UpdateUserAppearanceSettingsRequest struct

+ ThemePreference string

type User

+ ThemePreference string

Dec 12, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ var HealthSections = []HealthSection

type BuildInfoResponse

+ AgentAPIVersion string

type Client

+ func (c *Client) HealthSettings(ctx context.Context) (HealthSettings, error)

+ func (c *Client) ListExternalAuths(ctx context.Context) (ListUserExternalAuthResponse, error)

+ func (c *Client) PutHealthSettings(ctx context.Context, settings HealthSettings) error

+ func (c *Client) UnlinkExternalAuthByID(ctx context.Context, provider string) error

+ type ExternalAuthLink struct

+ Authenticated bool

+ CreatedAt time.Time

+ Expires time.Time

+ HasRefreshToken bool

+ ProviderID string

+ UpdatedAt time.Time

+ ValidateError string

+ type ExternalAuthLinkProvider struct

+ AllowRefresh bool

+ AllowValidate bool

+ Device bool

+ DisplayIcon string

+ DisplayName string

+ ID string

+ Type string

+ type HeaderTransport struct

+ Header http.Header

+ Transport http.RoundTripper

+ func (h *HeaderTransport) CloseIdleConnections()

+ func (h *HeaderTransport) RoundTrip(req *http.Request) (*http.Response, error)

+ type HealthSection string

+ const HealthSectionAccessURL

+ const HealthSectionDERP

+ const HealthSectionDatabase

+ const HealthSectionWebsocket

+ const HealthSectionWorkspaceProxy

+ type HealthSettings struct

+ DismissedHealthchecks []HealthSection

+ type ListUserExternalAuthResponse struct

+ Links []ExternalAuthLink

+ Providers []ExternalAuthLinkProvider

type OIDCConfig

+ GroupAllowList clibase.StringArray

type ProvisionerDaemon

+ LastSeenAt NullTime

+ Version string

type RBACResource

+ const ResourceTemplateInsights

type ResourceType

+ const ResourceTypeHealthSettings

type ServeProvisionerDaemonRequest

+ Name string

type Template

+ Deprecated bool

+ DeprecationMessage string

+ type UpdateHealthSettings struct

+ DismissedHealthchecks []HealthSection

type UpdateTemplateMeta

+ DeprecationMessage *string

type WorkspaceProxy

+ Version string

Nov 17, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const TemplateBuiltinAppDisplayNameJetBrains

+ const TemplateBuiltinAppDisplayNameSSH

+ const TemplateBuiltinAppDisplayNameVSCode

+ const TemplateBuiltinAppDisplayNameWebTerminal

type Client

+ func (c *Client) ResolveAutostart(ctx context.Context, workspaceID string) (ResolveAutostartResponse, error)

type DeploymentValues

+ Healthcheck HealthcheckConfig

type EnhancedExternalAuthProvider

+ const EnhancedExternalAuthProviderBitBucketCloud

+ const EnhancedExternalAuthProviderBitBucketServer

+ const EnhancedExternalAuthProviderJFrog

+ type HealthcheckConfig struct

+ Refresh clibase.Duration

+ ThresholdDatabase clibase.Duration

+ type ResolveAutostartResponse struct

+ ParameterMismatch bool

type TLSConfig

+ AllowInsecureCiphers clibase.Bool

+ SupportedCiphers clibase.StringArray

type WorkspaceAgent

+ APIVersion string

Oct 30, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 20, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type CreateTemplateRequest

+ RequireActiveVersion bool

type Experiment

+ const ExperimentTemplateUpdatePolicies

type FeatureName

+ const FeatureAccessControl

type ServeProvisionerDaemonRequest

+ ID uuid.UUID

type Template

+ RequireActiveVersion bool

type UpdateTemplateMeta

+ RequireActiveVersion bool

type Workspace

+ TemplateRequireActiveVersion bool

Oct 17, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type AvailableExperiments struct

+ Safe []Experiment

type Client

+ func (c *Client) SafeExperiments(ctx context.Context) (AvailableExperiments, error)

type CreateTemplateRequest

+ AutostartRequirement *TemplateAutostartRequirement

type Template

+ AutostartRequirement TemplateAutostartRequirement

+ type TemplateAutostartRequirement struct

+ DaysOfWeek []string

type UpdateTemplateMeta

+ AutostartRequirement *TemplateAutostartRequirement

Oct 11, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type ArchiveTemplateVersionsRequest struct

+ All bool

+ type ArchiveTemplateVersionsResponse struct

+ ArchivedIDs []uuid.UUID

+ TemplateID uuid.UUID

+ type AutomaticUpdates string

+ const AutomaticUpdatesAlways

+ const AutomaticUpdatesNever

type Client

+ func (c *Client) ArchiveTemplateVersions(ctx context.Context, template uuid.UUID, all bool) (ArchiveTemplateVersionsResponse, error)

+ func (c *Client) SetArchiveTemplateVersion(ctx context.Context, templateVersion uuid.UUID, archive bool) error

+ func (c *Client) UpdateWorkspaceAutomaticUpdates(ctx context.Context, id uuid.UUID, req UpdateWorkspaceAutomaticUpdatesRequest) error

type CreateWorkspaceRequest

+ AutomaticUpdates AutomaticUpdates

type DeploymentValues

+ WebTerminalRenderer clibase.String

type EnhancedExternalAuthProvider

+ const EnhancedExternalAuthProviderSlack

type Experiment

+ const ExperimentDashboardTheme

type ExternalAuthConfig

+ ExtraTokenKeys []string

type ProvisionerJobStatus

+ const ProvisionerJobUnknown

type TemplateVersion

+ Archived bool

type TemplateVersionsByTemplateRequest

+ IncludeArchived bool

+ type UpdateWorkspaceAutomaticUpdatesRequest struct

+ AutomaticUpdates AutomaticUpdates

type Workspace

+ AutomaticUpdates AutomaticUpdates

Oct 4, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ func DeploymentOptionsWithoutSecrets(set clibase.OptionSet) clibase.OptionSet

type Client

+ func (c *Client) ExternalAuthByID(ctx context.Context, provider string) (ExternalAuth, error)

+ func (c *Client) ExternalAuthDeviceByID(ctx context.Context, provider string) (ExternalAuthDevice, error)

+ func (c *Client) ExternalAuthDeviceExchange(ctx context.Context, provider string, req ExternalAuthDeviceExchange) error

+ func (c *Client) TemplateVersionExternalAuth(ctx context.Context, version uuid.UUID) ([]TemplateVersionExternalAuth, error)

type DeploymentValues

+ ExternalAuthConfigs clibase.Struct[[]ExternalAuthConfig]

+ type EnhancedExternalAuthProvider string

+ const EnhancedExternalAuthProviderAzureDevops

+ const EnhancedExternalAuthProviderBitBucket

+ const EnhancedExternalAuthProviderGitHub

+ const EnhancedExternalAuthProviderGitLab

+ func (e EnhancedExternalAuthProvider) Git() bool

+ func (e EnhancedExternalAuthProvider) String() string

type Error

+ func (e *Error) Method() string

+ func (e *Error) URL() string

+ type ExternalAuth struct

+ AppInstallURL string

+ AppInstallable bool

+ AppInstallations []ExternalAuthAppInstallation

+ Authenticated bool

+ Device bool

+ DisplayName string

+ User *ExternalAuthUser

+ type ExternalAuthAppInstallation struct

+ Account ExternalAuthUser

+ ConfigureURL string

+ ID int

+ type ExternalAuthConfig struct

+ AppInstallURL string

+ AppInstallationsURL string

+ AuthURL string

+ ClientID string

+ ClientSecret string

+ DeviceCodeURL string

+ DeviceFlow bool

+ DisplayIcon string

+ DisplayName string

+ ID string

+ NoRefresh bool

+ Regex string

+ Scopes []string

+ TokenURL string

+ Type string

+ ValidateURL string

+ type ExternalAuthDevice struct

+ DeviceCode string

+ ExpiresIn int

+ Interval int

+ UserCode string

+ VerificationURI string

+ type ExternalAuthDeviceExchange struct

+ DeviceCode string

+ type ExternalAuthUser struct

+ AvatarURL string

+ Login string

+ Name string

+ ProfileURL string

type FeatureName

+ const FeatureMultipleExternalAuth

type TemplateInsightsRequest

+ Sections []TemplateInsightsSection

+ type TemplateInsightsSection string

+ const TemplateInsightsSectionIntervalReports

+ const TemplateInsightsSectionReport

+ type TemplateVersionExternalAuth struct

+ AuthenticateURL string

+ Authenticated bool

+ DisplayIcon string

+ DisplayName string

+ ID string

+ Type string

Sep 27, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AppearanceConfig

+ ApplicationName string

type Client

+ func (c *Client) UserActivityInsights(ctx context.Context, req UserActivityInsightsRequest) (UserActivityInsightsResponse, error)

type DeploymentValues

+ ExternalTokenEncryptionKeys clibase.StringArray

type FeatureName

+ const FeatureExternalTokenEncryption

type InsightsReportInterval

+ const InsightsReportIntervalWeek

+ func (interval InsightsReportInterval) Days() int32

type UpdateAppearanceConfig

+ ApplicationName string

+ type UserActivity struct

+ AvatarURL string

+ Seconds int64

+ TemplateIDs []uuid.UUID

+ UserID uuid.UUID

+ Username string

+ type UserActivityInsightsReport struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ Users []UserActivity

+ type UserActivityInsightsRequest struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type UserActivityInsightsResponse struct

+ Report UserActivityInsightsReport

type WorkspaceAgent

+ LogSources []WorkspaceAgentLogSource

+ Scripts []WorkspaceAgentScript

type WorkspaceAgentLog

+ SourceID uuid.UUID

type WorkspaceAgentLogSource

+ CreatedAt time.Time

+ DisplayName string

+ ID uuid.UUID

+ Icon string

+ WorkspaceAgentID uuid.UUID

+ type WorkspaceAgentScript struct

+ Cron string

+ LogPath string

+ LogSourceID uuid.UUID

+ RunOnStart bool

+ RunOnStop bool

+ Script string

+ StartBlocksLogin bool

+ Timeout time.Duration

type WorkspaceApp

+ SubdomainName string

Sep 5, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const PathAppSessionTokenCookie

+ const SignedAppTokenCookie

+ const SubdomainAppSessionTokenCookie

+ func JobIsMissingParameterErrorCode(code JobErrorCode) bool

type CreateTemplateRequest

+ AutostopRequirement *TemplateAutostopRequirement

type CreateWorkspaceRequest

+ TemplateVersionID uuid.UUID

+ type DisplayApp string

+ const DisplayAppPortForward

+ const DisplayAppSSH

+ const DisplayAppVSCodeDesktop

+ const DisplayAppVSCodeInsiders

+ const DisplayAppWebTerminal

type Experiment

+ const ExperimentTemplateAutostopRequirement

type FeatureName

+ const FeatureTemplateAutostopRequirement

+ const FeatureWorkspaceBatchActions

type Template

+ AutostopRequirement TemplateAutostopRequirement

+ type TemplateAutostopRequirement struct

+ DaysOfWeek []string

+ Weeks int64

type TraceConfig

+ DataDog clibase.Bool

type UpdateTemplateMeta

+ AutostopRequirement *TemplateAutostopRequirement

type WorkspaceAgent

+ DisplayApps []DisplayApp

Aug 28, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type Client

+ func (c *Client) UpdateWorkspaceDormancy(ctx context.Context, id uuid.UUID, req UpdateWorkspaceDormancy) error

type CreateTemplateRequest

+ TimeTilDormantAutoDeleteMillis *int64

+ TimeTilDormantMillis *int64

type Template

+ TimeTilDormantAutoDeleteMillis int64

+ TimeTilDormantMillis int64

type UpdateTemplateMeta

+ TimeTilDormantAutoDeleteMillis int64

+ TimeTilDormantMillis int64

+ UpdateWorkspaceDormantAt bool

+ type UpdateWorkspaceDormancy struct

+ Dormant bool

type Workspace

+ DormantAt *time.Time

+ TemplateActiveVersionID uuid.UUID

Aug 24, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type DERPConfig

+ ForceWebSockets clibase.Bool

type WorkspaceAgentConnectionInfo

+ DERPForceWebSockets bool

Aug 23, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type UpdateTemplateMeta

+ UpdateWorkspaceLastUsedAt bool

+ UpdateWorkspaceLockedAt bool

Aug 22, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const ActionCreate

+ const ActionDelete

+ const ActionRead

+ const ActionUpdate

+ const BypassRatelimitHeader

+ const CLITelemetryHeader

+ const ContentTypeTar

+ const DevURLSessionTokenCookie

+ const DevURLSignedAppTokenCookie

+ const LicenseExpiryClaim

+ const LogLevelDebug

+ const LogLevelError

+ const LogLevelInfo

+ const LogLevelTrace

+ const LogLevelWarn

+ const LogSourceProvisioner

+ const LogSourceProvisionerDaemon

+ const OAuth2RedirectCookie

+ const OAuth2StateCookie

+ const ProvisionerDaemonPSK

+ const SessionTokenCookie

+ const SessionTokenHeader

+ const SignedAppTokenQueryParameter

+ const WorkspaceAgentHTTPAPIServerPort

+ const WorkspaceAgentMinimumListeningPort

+ const WorkspaceAgentReconnectingPTYPort

+ const WorkspaceAgentSSHPort

+ const WorkspaceAgentSpeedtestPort

+ var AllRBACActions = []string

+ var AllRBACResources = []RBACResource

+ var ErrSkipClose = xerrors.New("skip tailnet close")

+ var ExperimentsAll = Experiments

+ var FeatureNames = []FeatureName

+ var Me = "me"

+ var WorkspaceAgentIP = netip.MustParseAddr("fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4")

+ var WorkspaceAgentIgnoredListeningPorts = map[uint16]struct

+ var WorkspaceAgentLifecycleOrder = []WorkspaceAgentLifecycle

+ func BitmapToWeekdays(bitmap uint8) []string

+ func DefaultCacheDir() string

+ func IsConnectionError(err error) bool

+ func IsSecretDeploymentOption(opt clibase.Option) bool

+ func IsWorkspaceProxies(opt clibase.Option) bool

+ func ParseSSHConfigOption(opt string) (key string, value string, err error)

+ func ReadBodyAsError(res *http.Response) error

+ func ServerSentEventReader(ctx context.Context, rc io.ReadCloser) func() (*ServerSentEvent, error)

+ func TimezoneOffsetHour(loc *time.Location) int

+ func ValidateNewWorkspaceParameters(richParameters []TemplateVersionParameter, ...) error

+ func ValidateWorkspaceBuildParameter(richParameter TemplateVersionParameter, ...) error

+ func ValidateWorkspaceBuildParameters(richParameters []TemplateVersionParameter, ...) error

+ func WeekdaysToBitmap(days []string) (uint8, error)

+ func WorkspaceDisplayStatus(jobStatus ProvisionerJobStatus, transition WorkspaceTransition) string

+ func WorkspaceNotifyChannel(id uuid.UUID) string

+ type ACLAvailable struct

+ Groups []Group

+ Users []User

+ type APIKey struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ ID string

+ LastUsed time.Time

+ LifetimeSeconds int64

+ LoginType LoginType

+ Scope APIKeyScope

+ TokenName string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type APIKeyScope string

+ const APIKeyScopeAll

+ const APIKeyScopeApplicationConnect

+ type APIKeyWithOwner struct

+ Username string

+ type AddLicenseRequest struct

+ License string

+ type AgentStatsReportRequest struct

+ type AgentStatsReportResponse struct

+ NumConns int64

+ RxBytes int64

+ TxBytes int64

+ type AgentSubsystem string

+ const AgentSubsystemEnvbox

+ const AgentSubsystemEnvbuilder

+ const AgentSubsystemExectrace

+ func (s AgentSubsystem) Valid() bool

+ type AppHostResponse struct

+ Host string

+ type AppearanceConfig struct

+ LogoURL string

+ ServiceBanner ServiceBannerConfig

+ SupportLinks []LinkConfig

+ type AssignableRoles struct

+ Assignable bool

+ type AuditAction string

+ const AuditActionCreate

+ const AuditActionDelete

+ const AuditActionLogin

+ const AuditActionLogout

+ const AuditActionRegister

+ const AuditActionStart

+ const AuditActionStop

+ const AuditActionWrite

+ func (a AuditAction) Friendly() string

+ type AuditDiff map[string]AuditDiffField

+ type AuditDiffField struct

+ New any

+ Old any

+ Secret bool

+ type AuditLog struct

+ Action AuditAction

+ AdditionalFields json.RawMessage

+ Description string

+ Diff AuditDiff

+ ID uuid.UUID

+ IP netip.Addr

+ IsDeleted bool

+ OrganizationID uuid.UUID

+ RequestID uuid.UUID

+ ResourceID uuid.UUID

+ ResourceIcon string

+ ResourceLink string

+ ResourceTarget string

+ ResourceType ResourceType

+ StatusCode int32

+ Time time.Time

+ User *User

+ UserAgent string

+ type AuditLogResponse struct

+ AuditLogs []AuditLog

+ Count int64

+ type AuditLogsRequest struct

+ SearchQuery string

+ type AuthMethod struct

+ Enabled bool

+ type AuthMethods struct

+ Github AuthMethod

+ OIDC OIDCAuthMethod

+ Password AuthMethod

+ type AuthorizationCheck struct

+ Action string

+ Object AuthorizationObject

+ type AuthorizationObject struct

+ OrganizationID string

+ OwnerID string

+ ResourceID string

+ ResourceType RBACResource

+ type AuthorizationRequest struct

+ Checks map[string]AuthorizationCheck

+ type AuthorizationResponse map[string]bool

+ type BuildInfoResponse struct

+ DashboardURL string

+ ExternalURL string

+ Version string

+ WorkspaceProxy bool

+ func (b BuildInfoResponse) CanonicalVersion() string

+ type BuildReason string

+ const BuildReasonAutostart

+ const BuildReasonAutostop

+ const BuildReasonInitiator

+ type Client struct

+ DisableDirectConnections bool

+ HTTPClient *http.Client

+ PlainLogger io.Writer

+ SessionTokenHeader string

+ Trace bool

+ URL *url.URL

+ func New(serverURL *url.URL) *Client

+ func (c *Client) APIKeyByID(ctx context.Context, userID string, id string) (*APIKey, error)

+ func (c *Client) APIKeyByName(ctx context.Context, userID string, name string) (*APIKey, error)

+ func (c *Client) AddLicense(ctx context.Context, r AddLicenseRequest) (License, error)

+ func (c *Client) AppHost(ctx context.Context) (AppHostResponse, error)

+ func (c *Client) Appearance(ctx context.Context) (AppearanceConfig, error)

+ func (c *Client) AuditLogs(ctx context.Context, req AuditLogsRequest) (AuditLogResponse, error)

+ func (c *Client) AuthCheck(ctx context.Context, req AuthorizationRequest) (AuthorizationResponse, error)

+ func (c *Client) AuthMethods(ctx context.Context) (AuthMethods, error)

+ func (c *Client) BuildInfo(ctx context.Context) (BuildInfoResponse, error)

+ func (c *Client) CancelTemplateVersion(ctx context.Context, version uuid.UUID) error

+ func (c *Client) CancelTemplateVersionDryRun(ctx context.Context, version, job uuid.UUID) error

+ func (c *Client) CancelWorkspaceBuild(ctx context.Context, id uuid.UUID) error

+ func (c *Client) ConvertLoginType(ctx context.Context, req ConvertLoginRequest) (OAuthConversionResponse, error)

+ func (c *Client) CreateAPIKey(ctx context.Context, user string) (GenerateAPIKeyResponse, error)

+ func (c *Client) CreateFirstUser(ctx context.Context, req CreateFirstUserRequest) (CreateFirstUserResponse, error)

+ func (c *Client) CreateGroup(ctx context.Context, orgID uuid.UUID, req CreateGroupRequest) (Group, error)

+ func (c *Client) CreateOrganization(ctx context.Context, req CreateOrganizationRequest) (Organization, error)

+ func (c *Client) CreateTemplate(ctx context.Context, organizationID uuid.UUID, request CreateTemplateRequest) (Template, error)

+ func (c *Client) CreateTemplateVersion(ctx context.Context, organizationID uuid.UUID, ...) (TemplateVersion, error)

+ func (c *Client) CreateTemplateVersionDryRun(ctx context.Context, version uuid.UUID, req CreateTemplateVersionDryRunRequest) (ProvisionerJob, error)

+ func (c *Client) CreateTestAuditLog(ctx context.Context, req CreateTestAuditLogRequest) error

+ func (c *Client) CreateToken(ctx context.Context, userID string, req CreateTokenRequest) (GenerateAPIKeyResponse, error)

+ func (c *Client) CreateUser(ctx context.Context, req CreateUserRequest) (User, error)

+ func (c *Client) CreateWorkspace(ctx context.Context, organizationID uuid.UUID, user string, ...) (Workspace, error)

+ func (c *Client) CreateWorkspaceBuild(ctx context.Context, workspace uuid.UUID, request CreateWorkspaceBuildRequest) (WorkspaceBuild, error)

+ func (c *Client) CreateWorkspaceProxy(ctx context.Context, req CreateWorkspaceProxyRequest) (UpdateWorkspaceProxyResponse, error)

+ func (c *Client) DeleteAPIKey(ctx context.Context, userID string, id string) error

+ func (c *Client) DeleteGroup(ctx context.Context, group uuid.UUID) error

+ func (c *Client) DeleteLicense(ctx context.Context, id int32) error

+ func (c *Client) DeleteTemplate(ctx context.Context, template uuid.UUID) error

+ func (c *Client) DeleteUser(ctx context.Context, id uuid.UUID) error

+ func (c *Client) DeleteWorkspaceProxyByID(ctx context.Context, id uuid.UUID) error

+ func (c *Client) DeleteWorkspaceProxyByName(ctx context.Context, name string) error

+ func (c *Client) DeletedWorkspace(ctx context.Context, id uuid.UUID) (Workspace, error)

+ func (c *Client) DeploymentConfig(ctx context.Context) (*DeploymentConfig, error)

+ func (c *Client) DeploymentDAUs(ctx context.Context, tzOffset int) (*DAUsResponse, error)

+ func (c *Client) DeploymentDAUsLocalTZ(ctx context.Context) (*DAUsResponse, error)

+ func (c *Client) DeploymentStats(ctx context.Context) (DeploymentStats, error)

+ func (c *Client) DialWorkspaceAgent(ctx context.Context, agentID uuid.UUID, options *DialWorkspaceAgentOptions) (agentConn *WorkspaceAgentConn, err error)

+ func (c *Client) Download(ctx context.Context, id uuid.UUID) ([]byte, string, error)

+ func (c *Client) Entitlements(ctx context.Context) (Entitlements, error)

+ func (c *Client) Experiments(ctx context.Context) (Experiments, error)

+ func (c *Client) GetTokenConfig(ctx context.Context, userID string) (TokenConfig, error)

+ func (c *Client) GitAuthByID(ctx context.Context, provider string) (GitAuth, error)

+ func (c *Client) GitAuthDeviceByID(ctx context.Context, provider string) (GitAuthDevice, error)

+ func (c *Client) GitAuthDeviceExchange(ctx context.Context, provider string, req GitAuthDeviceExchange) error

+ func (c *Client) GitSSHKey(ctx context.Context, user string) (GitSSHKey, error)

+ func (c *Client) Group(ctx context.Context, group uuid.UUID) (Group, error)

+ func (c *Client) GroupByOrgAndName(ctx context.Context, orgID uuid.UUID, name string) (Group, error)

+ func (c *Client) GroupsByOrganization(ctx context.Context, orgID uuid.UUID) ([]Group, error)

+ func (c *Client) HasFirstUser(ctx context.Context) (bool, error)

+ func (c *Client) IssueReconnectingPTYSignedToken(ctx context.Context, req IssueReconnectingPTYSignedTokenRequest) (IssueReconnectingPTYSignedTokenResponse, error)

+ func (c *Client) Licenses(ctx context.Context) ([]License, error)

+ func (c *Client) ListOrganizationRoles(ctx context.Context, org uuid.UUID) ([]AssignableRoles, error)

+ func (c *Client) ListSiteRoles(ctx context.Context) ([]AssignableRoles, error)

+ func (c *Client) LogBodies() bool

+ func (c *Client) Logger() slog.Logger

+ func (c *Client) LoginWithPassword(ctx context.Context, req LoginWithPasswordRequest) (LoginWithPasswordResponse, error)

+ func (c *Client) Logout(ctx context.Context) error

+ func (c *Client) Organization(ctx context.Context, id uuid.UUID) (Organization, error)

+ func (c *Client) OrganizationByName(ctx context.Context, user string, name string) (Organization, error)

+ func (c *Client) OrganizationsByUser(ctx context.Context, user string) ([]Organization, error)

+ func (c *Client) PatchGroup(ctx context.Context, group uuid.UUID, req PatchGroupRequest) (Group, error)

+ func (c *Client) PatchWorkspaceProxy(ctx context.Context, req PatchWorkspaceProxy) (UpdateWorkspaceProxyResponse, error)

+ func (c *Client) PreviousTemplateVersion(ctx context.Context, organization uuid.UUID, templateName, versionName string) (TemplateVersion, error)

+ func (c *Client) ProvisionerDaemons(ctx context.Context) ([]ProvisionerDaemon, error)

+ func (c *Client) PutExtendWorkspace(ctx context.Context, id uuid.UUID, req PutExtendWorkspaceRequest) error

+ func (c *Client) RegenerateGitSSHKey(ctx context.Context, user string) (GitSSHKey, error)

+ func (c *Client) Regions(ctx context.Context) ([]Region, error)

+ func (c *Client) Replicas(ctx context.Context) ([]Replica, error)

+ func (c *Client) Request(ctx context.Context, method, path string, body interface{}, ...) (*http.Response, error)

+ func (c *Client) SSHConfiguration(ctx context.Context) (SSHConfigResponse, error)

+ func (c *Client) ServeProvisionerDaemon(ctx context.Context, req ServeProvisionerDaemonRequest) (proto.DRPCProvisionerDaemonClient, error)

+ func (c *Client) SessionToken() string

+ func (c *Client) SetLogBodies(logBodies bool)

+ func (c *Client) SetLogger(logger slog.Logger)

+ func (c *Client) SetSessionToken(token string)

+ func (c *Client) Template(ctx context.Context, template uuid.UUID) (Template, error)

+ func (c *Client) TemplateACL(ctx context.Context, templateID uuid.UUID) (TemplateACL, error)

+ func (c *Client) TemplateACLAvailable(ctx context.Context, templateID uuid.UUID) (ACLAvailable, error)

+ func (c *Client) TemplateByName(ctx context.Context, organizationID uuid.UUID, name string) (Template, error)

+ func (c *Client) TemplateDAUs(ctx context.Context, templateID uuid.UUID, tzOffset int) (*DAUsResponse, error)

+ func (c *Client) TemplateDAUsLocalTZ(ctx context.Context, templateID uuid.UUID) (*DAUsResponse, error)

+ func (c *Client) TemplateExamples(ctx context.Context, organizationID uuid.UUID) ([]TemplateExample, error)

+ func (c *Client) TemplateInsights(ctx context.Context, req TemplateInsightsRequest) (TemplateInsightsResponse, error)

+ func (c *Client) TemplateVersion(ctx context.Context, id uuid.UUID) (TemplateVersion, error)

+ func (c *Client) TemplateVersionByName(ctx context.Context, template uuid.UUID, name string) (TemplateVersion, error)

+ func (c *Client) TemplateVersionByOrganizationAndName(ctx context.Context, organizationID uuid.UUID, ...) (TemplateVersion, error)

+ func (c *Client) TemplateVersionDryRun(ctx context.Context, version, job uuid.UUID) (ProvisionerJob, error)

+ func (c *Client) TemplateVersionDryRunLogsAfter(ctx context.Context, version, job uuid.UUID, after int64) (<-chan ProvisionerJobLog, io.Closer, error)

+ func (c *Client) TemplateVersionDryRunResources(ctx context.Context, version, job uuid.UUID) ([]WorkspaceResource, error)

+ func (c *Client) TemplateVersionGitAuth(ctx context.Context, version uuid.UUID) ([]TemplateVersionGitAuth, error)

+ func (c *Client) TemplateVersionLogsAfter(ctx context.Context, version uuid.UUID, after int64) (<-chan ProvisionerJobLog, io.Closer, error)

+ func (c *Client) TemplateVersionResources(ctx context.Context, version uuid.UUID) ([]WorkspaceResource, error)

+ func (c *Client) TemplateVersionRichParameters(ctx context.Context, version uuid.UUID) ([]TemplateVersionParameter, error)

+ func (c *Client) TemplateVersionVariables(ctx context.Context, version uuid.UUID) ([]TemplateVersionVariable, error)

+ func (c *Client) TemplateVersionsByTemplate(ctx context.Context, req TemplateVersionsByTemplateRequest) ([]TemplateVersion, error)

+ func (c *Client) TemplatesByOrganization(ctx context.Context, organizationID uuid.UUID) ([]Template, error)

+ func (c *Client) Tokens(ctx context.Context, userID string, filter TokensFilter) ([]APIKeyWithOwner, error)

+ func (c *Client) UpdateActiveTemplateVersion(ctx context.Context, template uuid.UUID, req UpdateActiveTemplateVersion) error

+ func (c *Client) UpdateAppearance(ctx context.Context, appearance UpdateAppearanceConfig) error

+ func (c *Client) UpdateCheck(ctx context.Context) (UpdateCheckResponse, error)

+ func (c *Client) UpdateOrganizationMemberRoles(ctx context.Context, organizationID uuid.UUID, user string, req UpdateRoles) (OrganizationMember, error)

+ func (c *Client) UpdateTemplateACL(ctx context.Context, templateID uuid.UUID, req UpdateTemplateACL) error

+ func (c *Client) UpdateTemplateMeta(ctx context.Context, templateID uuid.UUID, req UpdateTemplateMeta) (Template, error)

+ func (c *Client) UpdateTemplateVersion(ctx context.Context, versionID uuid.UUID, req PatchTemplateVersionRequest) (TemplateVersion, error)

+ func (c *Client) UpdateUserPassword(ctx context.Context, user string, req UpdateUserPasswordRequest) error

+ func (c *Client) UpdateUserProfile(ctx context.Context, user string, req UpdateUserProfileRequest) (User, error)

+ func (c *Client) UpdateUserQuietHoursSchedule(ctx context.Context, userIdent string, req UpdateUserQuietHoursScheduleRequest) (UserQuietHoursScheduleResponse, error)

+ func (c *Client) UpdateUserRoles(ctx context.Context, user string, req UpdateRoles) (User, error)

+ func (c *Client) UpdateUserStatus(ctx context.Context, user string, status UserStatus) (User, error)

+ func (c *Client) UpdateWorkspace(ctx context.Context, id uuid.UUID, req UpdateWorkspaceRequest) error

+ func (c *Client) UpdateWorkspaceAutostart(ctx context.Context, id uuid.UUID, req UpdateWorkspaceAutostartRequest) error

+ func (c *Client) UpdateWorkspaceLock(ctx context.Context, id uuid.UUID, req UpdateWorkspaceLock) error

+ func (c *Client) UpdateWorkspaceTTL(ctx context.Context, id uuid.UUID, req UpdateWorkspaceTTLRequest) error

+ func (c *Client) Upload(ctx context.Context, contentType string, rd io.Reader) (UploadResponse, error)

+ func (c *Client) User(ctx context.Context, userIdent string) (User, error)

+ func (c *Client) UserLatencyInsights(ctx context.Context, req UserLatencyInsightsRequest) (UserLatencyInsightsResponse, error)

+ func (c *Client) UserQuietHoursSchedule(ctx context.Context, userIdent string) (UserQuietHoursScheduleResponse, error)

+ func (c *Client) UserRoles(ctx context.Context, user string) (UserRoles, error)

+ func (c *Client) Users(ctx context.Context, req UsersRequest) (GetUsersResponse, error)

+ func (c *Client) WatchWorkspace(ctx context.Context, id uuid.UUID) (<-chan Workspace, error)

+ func (c *Client) WatchWorkspaceAgentMetadata(ctx context.Context, id uuid.UUID) (<-chan []WorkspaceAgentMetadata, <-chan error)

+ func (c *Client) Workspace(ctx context.Context, id uuid.UUID) (Workspace, error)

+ func (c *Client) WorkspaceAgent(ctx context.Context, id uuid.UUID) (WorkspaceAgent, error)

+ func (c *Client) WorkspaceAgentConnectionInfo(ctx context.Context, agentID uuid.UUID) (WorkspaceAgentConnectionInfo, error)

+ func (c *Client) WorkspaceAgentConnectionInfoGeneric(ctx context.Context) (WorkspaceAgentConnectionInfo, error)

+ func (c *Client) WorkspaceAgentListeningPorts(ctx context.Context, agentID uuid.UUID) (WorkspaceAgentListeningPortsResponse, error)

+ func (c *Client) WorkspaceAgentLogsAfter(ctx context.Context, agentID uuid.UUID, after int64, follow bool) (<-chan []WorkspaceAgentLog, io.Closer, error)

+ func (c *Client) WorkspaceAgentReconnectingPTY(ctx context.Context, opts WorkspaceAgentReconnectingPTYOpts) (net.Conn, error)

+ func (c *Client) WorkspaceBuild(ctx context.Context, id uuid.UUID) (WorkspaceBuild, error)

+ func (c *Client) WorkspaceBuildByUsernameAndWorkspaceNameAndBuildNumber(ctx context.Context, username string, workspaceName string, buildNumber string) (WorkspaceBuild, error)

+ func (c *Client) WorkspaceBuildLogsAfter(ctx context.Context, build uuid.UUID, after int64) (<-chan ProvisionerJobLog, io.Closer, error)

+ func (c *Client) WorkspaceBuildParameters(ctx context.Context, build uuid.UUID) ([]WorkspaceBuildParameter, error)

+ func (c *Client) WorkspaceBuildState(ctx context.Context, build uuid.UUID) ([]byte, error)

+ func (c *Client) WorkspaceBuilds(ctx context.Context, req WorkspaceBuildsRequest) ([]WorkspaceBuild, error)

+ func (c *Client) WorkspaceByOwnerAndName(ctx context.Context, owner string, name string, params WorkspaceOptions) (Workspace, error)

+ func (c *Client) WorkspaceProxies(ctx context.Context) (RegionsResponse[WorkspaceProxy], error)

+ func (c *Client) WorkspaceProxyByID(ctx context.Context, id uuid.UUID) (WorkspaceProxy, error)

+ func (c *Client) WorkspaceProxyByName(ctx context.Context, name string) (WorkspaceProxy, error)

+ func (c *Client) WorkspaceQuota(ctx context.Context, userID string) (WorkspaceQuota, error)

+ func (c *Client) Workspaces(ctx context.Context, filter WorkspaceFilter) (WorkspacesResponse, error)

+ type ConnectionLatency struct

+ P50 float64

+ P95 float64

+ type ConvertLoginRequest struct

+ Password string

+ ToType LoginType

+ type CreateFirstUserRequest struct

+ Email string

+ Password string

+ Trial bool

+ Username string

+ type CreateFirstUserResponse struct

+ OrganizationID uuid.UUID

+ UserID uuid.UUID

+ type CreateGroupRequest struct

+ AvatarURL string

+ DisplayName string

+ Name string

+ QuotaAllowance int

+ type CreateOrganizationRequest struct

+ Name string

+ type CreateTemplateRequest struct

+ AllowUserAutostart *bool

+ AllowUserAutostop *bool

+ AllowUserCancelWorkspaceJobs *bool

+ DefaultTTLMillis *int64

+ Description string

+ DisableEveryoneGroupAccess bool

+ DisplayName string

+ FailureTTLMillis *int64

+ Icon string

+ InactivityTTLMillis *int64

+ LockedTTLMillis *int64

+ MaxTTLMillis *int64

+ Name string

+ RestartRequirement *TemplateRestartRequirement

+ VersionID uuid.UUID

+ type CreateTemplateVersionDryRunRequest struct

+ RichParameterValues []WorkspaceBuildParameter

+ UserVariableValues []VariableValue

+ WorkspaceName string

+ type CreateTemplateVersionRequest struct

+ ExampleID string

+ FileID uuid.UUID

+ Message string

+ Name string

+ Provisioner ProvisionerType

+ ProvisionerTags map[string]string

+ StorageMethod ProvisionerStorageMethod

+ TemplateID uuid.UUID

+ UserVariableValues []VariableValue

+ type CreateTestAuditLogRequest struct

+ Action AuditAction

+ AdditionalFields json.RawMessage

+ BuildReason BuildReason

+ ResourceID uuid.UUID

+ ResourceType ResourceType

+ Time time.Time

+ type CreateTokenRequest struct

+ Lifetime time.Duration

+ Scope APIKeyScope

+ TokenName string

+ type CreateUserRequest struct

+ DisableLogin bool

+ Email string

+ OrganizationID uuid.UUID

+ Password string

+ UserLoginType LoginType

+ Username string

+ type CreateWorkspaceBuildRequest struct

+ DryRun bool

+ LogLevel ProvisionerLogLevel

+ Orphan bool

+ ProvisionerState []byte

+ RichParameterValues []WorkspaceBuildParameter

+ TemplateVersionID uuid.UUID

+ Transition WorkspaceTransition

+ type CreateWorkspaceProxyRequest struct

+ DisplayName string

+ Icon string

+ Name string

+ type CreateWorkspaceRequest struct

+ AutostartSchedule *string

+ Name string

+ RichParameterValues []WorkspaceBuildParameter

+ TTLMillis *int64

+ TemplateID uuid.UUID

+ type DAUEntry struct

+ Amount int

+ Date time.Time

+ type DAURequest struct

+ TZHourOffset int

+ type DAUsResponse struct

+ Entries []DAUEntry

+ TZHourOffset int

+ type DERP struct

+ Config DERPConfig

+ Server DERPServerConfig

+ type DERPConfig struct

+ BlockDirect clibase.Bool

+ Path clibase.String

+ URL clibase.String

+ type DERPRegion struct

+ LatencyMilliseconds float64

+ Preferred bool

+ type DERPServerConfig struct

+ Enable clibase.Bool

+ RegionCode clibase.String

+ RegionID clibase.Int64

+ RegionName clibase.String

+ RelayURL clibase.URL

+ STUNAddresses clibase.StringArray

+ type DangerousConfig struct

+ AllowAllCors clibase.Bool

+ AllowPathAppSharing clibase.Bool

+ AllowPathAppSiteOwnerAccess clibase.Bool

+ type DeploymentConfig struct

+ Options clibase.OptionSet

+ Values *DeploymentValues

+ type DeploymentStats struct

+ AggregatedFrom time.Time

+ CollectedAt time.Time

+ NextUpdateAt time.Time

+ SessionCount SessionCountDeploymentStats

+ Workspaces WorkspaceDeploymentStats

+ type DeploymentValues struct

+ AccessURL clibase.URL

+ Address clibase.HostPort

+ AgentFallbackTroubleshootingURL clibase.URL

+ AgentStatRefreshInterval clibase.Duration

+ AutobuildPollInterval clibase.Duration

+ BrowserOnly clibase.Bool

+ CacheDir clibase.String

+ Config clibase.YAMLConfigPath

+ DERP DERP

+ Dangerous DangerousConfig

+ DisableOwnerWorkspaceExec clibase.Bool

+ DisablePasswordAuth clibase.Bool

+ DisablePathApps clibase.Bool

+ DisableSessionExpiryRefresh clibase.Bool

+ DocsURL clibase.URL

+ EnableTerraformDebugMode clibase.Bool

+ Experiments clibase.StringArray

+ GitAuthProviders clibase.Struct[[]GitAuthConfig]

+ HTTPAddress clibase.String

+ InMemoryDatabase clibase.Bool

+ JobHangDetectorInterval clibase.Duration

+ Logging LoggingConfig

+ MaxTokenLifetime clibase.Duration

+ MetricsCacheRefreshInterval clibase.Duration

+ OAuth2 OAuth2Config

+ OIDC OIDCConfig

+ PostgresURL clibase.String

+ Pprof PprofConfig

+ Prometheus PrometheusConfig

+ Provisioner ProvisionerConfig

+ ProxyHealthStatusInterval clibase.Duration

+ ProxyTrustedHeaders clibase.StringArray

+ ProxyTrustedOrigins clibase.StringArray

+ RateLimit RateLimitConfig

+ RedirectToAccessURL clibase.Bool

+ SCIMAPIKey clibase.String

+ SSHConfig SSHConfig

+ SSHKeygenAlgorithm clibase.String

+ SecureAuthCookie clibase.Bool

+ SessionDuration clibase.Duration

+ StrictTransportSecurity clibase.Int64

+ StrictTransportSecurityOptions clibase.StringArray

+ Support SupportConfig

+ Swagger SwaggerConfig

+ TLS TLSConfig

+ Telemetry TelemetryConfig

+ Trace TraceConfig

+ UpdateCheck clibase.Bool

+ UserQuietHoursSchedule UserQuietHoursScheduleConfig

+ Verbose clibase.Bool

+ WgtunnelHost clibase.String

+ WildcardAccessURL clibase.URL

+ WriteConfig clibase.Bool

+ func (c *DeploymentValues) Options() clibase.OptionSet

+ func (c *DeploymentValues) WithoutSecrets() (*DeploymentValues, error)

+ type DialWorkspaceAgentOptions struct

+ BlockEndpoints bool

+ Logger slog.Logger

+ type Entitlement string

+ const EntitlementEntitled

+ const EntitlementGracePeriod

+ const EntitlementNotEntitled

+ type Entitlements struct

+ Errors []string

+ Features map[FeatureName]Feature

+ HasLicense bool

+ RefreshedAt time.Time

+ RequireTelemetry bool

+ Trial bool

+ Warnings []string

+ type Error struct

+ Helper string

+ func AsError(err error) (*Error, bool)

+ func (e *Error) Error() string

+ func (e *Error) Friendly() string

+ func (e *Error) StatusCode() int

+ type Experiment string

+ const ExperimentDeploymentHealthPage

+ const ExperimentMoons

+ const ExperimentSingleTailnet

+ const ExperimentTailnetPGCoordinator

+ const ExperimentTemplateRestartRequirement

+ const ExperimentWorkspaceActions

+ const ExperimentWorkspacesBatchActions

+ type Experiments []Experiment

+ func (e Experiments) Enabled(ex Experiment) bool

+ type Feature struct

+ Actual *int64

+ Enabled bool

+ Entitlement Entitlement

+ Limit *int64

+ type FeatureName string

+ const FeatureAdvancedTemplateScheduling

+ const FeatureAppearance

+ const FeatureAuditLog

+ const FeatureBrowserOnly

+ const FeatureExternalProvisionerDaemons

+ const FeatureHighAvailability

+ const FeatureMultipleGitAuth

+ const FeatureSCIM

+ const FeatureTemplateRBAC

+ const FeatureTemplateRestartRequirement

+ const FeatureUserLimit

+ const FeatureUserRoleManagement

+ const FeatureWorkspaceProxy

+ func (n FeatureName) AlwaysEnable() bool

+ func (n FeatureName) Humanize() string

+ type GenerateAPIKeyResponse struct

+ Key string

+ type GetUsersResponse struct

+ Count int

+ Users []User

+ type GitAuth struct

+ AppInstallURL string

+ AppInstallable bool

+ AppInstallations []GitAuthAppInstallation

+ Authenticated bool

+ Device bool

+ Type string

+ User *GitAuthUser

+ type GitAuthAppInstallation struct

+ Account GitAuthUser

+ ConfigureURL string

+ ID int

+ type GitAuthConfig struct

+ AppInstallURL string

+ AppInstallationsURL string

+ AuthURL string

+ ClientID string

+ ClientSecret string

+ DeviceCodeURL string

+ DeviceFlow bool

+ ID string

+ NoRefresh bool

+ Regex string

+ Scopes []string

+ TokenURL string

+ Type string

+ ValidateURL string

+ type GitAuthDevice struct

+ DeviceCode string

+ ExpiresIn int

+ Interval int

+ UserCode string

+ VerificationURI string

+ type GitAuthDeviceExchange struct

+ DeviceCode string

+ type GitAuthUser struct

+ AvatarURL string

+ Login string

+ Name string

+ ProfileURL string

+ type GitProvider string

+ const GitProviderAzureDevops

+ const GitProviderBitBucket

+ const GitProviderGitHub

+ const GitProviderGitLab

+ func (g GitProvider) Pretty() string

+ type GitSSHKey struct

+ CreatedAt time.Time

+ PublicKey string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type Group struct

+ AvatarURL string

+ DisplayName string

+ ID uuid.UUID

+ Members []User

+ Name string

+ OrganizationID uuid.UUID

+ QuotaAllowance int

+ Source GroupSource

+ func (g Group) IsEveryone() bool

+ type GroupSource string

+ const GroupSourceOIDC

+ const GroupSourceUser

+ type Healthcheck struct

+ Interval int32

+ Threshold int32

+ URL string

+ type InsightsReportInterval string

+ const InsightsReportIntervalDay

+ type IssueReconnectingPTYSignedTokenRequest struct

+ AgentID uuid.UUID

+ URL string

+ type IssueReconnectingPTYSignedTokenResponse struct

+ SignedToken string

+ type JobErrorCode string

+ const MissingTemplateParameter

+ const RequiredTemplateVariables

+ type License struct

+ Claims map[string]interface{}

+ ID int32

+ UUID uuid.UUID

+ UploadedAt time.Time

+ func (l *License) AllFeaturesClaim() bool

+ func (l *License) ExpiresAt() (time.Time, error)

+ func (l *License) FeaturesClaims() (map[FeatureName]int64, error)

+ func (l *License) Trial() bool

+ type LinkConfig struct

+ Icon string

+ Name string

+ Target string

+ type LogLevel string

+ type LogSource string

+ type LoggingConfig struct

+ Filter clibase.StringArray

+ Human clibase.String

+ JSON clibase.String

+ Stackdriver clibase.String

+ type LoginType string

+ const LoginTypeGithub

+ const LoginTypeNone

+ const LoginTypeOIDC

+ const LoginTypePassword

+ const LoginTypeToken

+ const LoginTypeUnknown

+ type LoginWithPasswordRequest struct

+ Email string

+ Password string

+ type LoginWithPasswordResponse struct

+ SessionToken string

+ type MinimalUser struct

+ AvatarURL string

+ ID uuid.UUID

+ Username string

+ type NullTime struct

+ func NewNullTime(t time.Time, valid bool) NullTime

+ func (t *NullTime) UnmarshalJSON(data []byte) error

+ func (t NullTime) IsZero() bool

+ func (t NullTime) MarshalJSON() ([]byte, error)

+ type OAuth2Config struct

+ Github OAuth2GithubConfig

+ type OAuth2GithubConfig struct

+ AllowEveryone clibase.Bool

+ AllowSignups clibase.Bool

+ AllowedOrgs clibase.StringArray

+ AllowedTeams clibase.StringArray

+ ClientID clibase.String

+ ClientSecret clibase.String

+ EnterpriseBaseURL clibase.String

+ type OAuthConversionResponse struct

+ ExpiresAt time.Time

+ StateString string

+ ToType LoginType

+ UserID uuid.UUID

+ type OIDCAuthMethod struct

+ IconURL string

+ SignInText string

+ type OIDCConfig struct

+ AllowSignups clibase.Bool

+ AuthURLParams clibase.Struct[map[string]string]

+ ClientCertFile clibase.String

+ ClientID clibase.String

+ ClientKeyFile clibase.String

+ ClientSecret clibase.String

+ EmailDomain clibase.StringArray

+ EmailField clibase.String

+ GroupAutoCreate clibase.Bool

+ GroupField clibase.String

+ GroupMapping clibase.Struct[map[string]string]

+ GroupRegexFilter clibase.Regexp

+ IconURL clibase.URL

+ IgnoreEmailVerified clibase.Bool

+ IgnoreUserInfo clibase.Bool

+ IssuerURL clibase.String

+ Scopes clibase.StringArray

+ SignInText clibase.String

+ UserRoleField clibase.String

+ UserRoleMapping clibase.Struct[map[string][]string]

+ UserRolesDefault clibase.StringArray

+ UsernameField clibase.String

+ type Organization struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

+ type OrganizationMember struct

+ CreatedAt time.Time

+ OrganizationID uuid.UUID

+ Roles []Role

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type Pagination struct

+ AfterID uuid.UUID

+ Limit int

+ Offset int

+ type ParameterResolver struct

+ Rich []WorkspaceBuildParameter

+ func (r *ParameterResolver) ValidateResolve(p TemplateVersionParameter, v *WorkspaceBuildParameter) (value string, err error)

+ type PatchGroupRequest struct

+ AddUsers []string

+ AvatarURL *string

+ DisplayName *string

+ Name string

+ QuotaAllowance *int

+ RemoveUsers []string

+ type PatchTemplateVersionRequest struct

+ Message *string

+ Name string

+ type PatchWorkspaceProxy struct

+ DisplayName string

+ ID uuid.UUID

+ Icon string

+ Name string

+ RegenerateToken bool

+ type PprofConfig struct

+ Address clibase.HostPort

+ Enable clibase.Bool

+ type PrometheusConfig struct

+ Address clibase.HostPort

+ CollectAgentStats clibase.Bool

+ CollectDBMetrics clibase.Bool

+ Enable clibase.Bool

+ type ProvisionerConfig struct

+ DaemonPSK clibase.String

+ DaemonPollInterval clibase.Duration

+ DaemonPollJitter clibase.Duration

+ Daemons clibase.Int64

+ DaemonsEcho clibase.Bool

+ ForceCancelInterval clibase.Duration

+ type ProvisionerDaemon struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Name string

+ Provisioners []ProvisionerType

+ Tags map[string]string

+ UpdatedAt sql.NullTime

+ type ProvisionerJob struct

+ CanceledAt *time.Time

+ CompletedAt *time.Time

+ CreatedAt time.Time

+ Error string

+ ErrorCode JobErrorCode

+ FileID uuid.UUID

+ ID uuid.UUID

+ QueuePosition int

+ QueueSize int

+ StartedAt *time.Time

+ Status ProvisionerJobStatus

+ Tags map[string]string

+ WorkerID *uuid.UUID

+ type ProvisionerJobLog struct

+ CreatedAt time.Time

+ ID int64

+ Level LogLevel

+ Output string

+ Source LogSource

+ Stage string

+ type ProvisionerJobStatus string

+ const ProvisionerJobCanceled

+ const ProvisionerJobCanceling

+ const ProvisionerJobFailed

+ const ProvisionerJobPending

+ const ProvisionerJobRunning

+ const ProvisionerJobSucceeded

+ func (p ProvisionerJobStatus) Active() bool

+ type ProvisionerLogLevel string

+ const ProvisionerLogLevelDebug

+ type ProvisionerStorageMethod string

+ const ProvisionerStorageMethodFile

+ type ProvisionerType string

+ const ProvisionerTypeEcho

+ const ProvisionerTypeTerraform

+ type ProxyHealthReport struct

+ Errors []string

+ Warnings []string

+ type ProxyHealthStatus string

+ const ProxyHealthy

+ const ProxyUnhealthy

+ const ProxyUnreachable

+ const ProxyUnregistered

+ type PutExtendWorkspaceRequest struct

+ Deadline time.Time

+ type RBACResource string

+ const ResourceAPIKey

+ const ResourceAuditLog

+ const ResourceDebugInfo

+ const ResourceDeploymentStats

+ const ResourceDeploymentValues

+ const ResourceFile

+ const ResourceGroup

+ const ResourceLicense

+ const ResourceOrgRoleAssignment

+ const ResourceOrganization

+ const ResourceOrganizationMember

+ const ResourceProvisionerDaemon

+ const ResourceReplicas

+ const ResourceRoleAssignment

+ const ResourceSystem

+ const ResourceTemplate

+ const ResourceUser

+ const ResourceUserData

+ const ResourceWorkspace

+ const ResourceWorkspaceApplicationConnect

+ const ResourceWorkspaceExecution

+ const ResourceWorkspaceProxy

+ func (r RBACResource) String() string

+ type RateLimitConfig struct

+ API clibase.Int64

+ DisableAll clibase.Bool

+ type ReconnectingPTYRequest struct

+ Data string

+ Height uint16

+ Width uint16

+ type Region struct

+ DisplayName string

+ Healthy bool

+ ID uuid.UUID

+ IconURL string

+ Name string

+ PathAppURL string

+ WildcardHostname string

+ type RegionTypes interface

+ type RegionsResponse struct

+ Regions []R

+ type Replica struct

+ CreatedAt time.Time

+ DatabaseLatency int32

+ Error string

+ Hostname string

+ ID uuid.UUID

+ RegionID int32

+ RelayAddress string

+ type RequestOption func(*http.Request)

+ func WithQueryParam(key, value string) RequestOption

+ type ResourceType string

+ const ResourceTypeAPIKey

+ const ResourceTypeConvertLogin

+ const ResourceTypeGitSSHKey

+ const ResourceTypeGroup

+ const ResourceTypeLicense

+ const ResourceTypeOrganization

+ const ResourceTypeTemplate

+ const ResourceTypeTemplateVersion

+ const ResourceTypeUser

+ const ResourceTypeWorkspace

+ const ResourceTypeWorkspaceBuild

+ const ResourceTypeWorkspaceProxy

+ func (r ResourceType) FriendlyString() string

+ type Response struct

+ Detail string

+ Message string

+ Validations []ValidationError

+ type Role struct

+ DisplayName string

+ Name string

+ type SSHConfig struct

+ DeploymentName clibase.String

+ SSHConfigOptions clibase.StringArray

+ func (c SSHConfig) ParseOptions() (map[string]string, error)

+ type SSHConfigResponse struct

+ HostnamePrefix string

+ SSHConfigOptions map[string]string

+ type ServeProvisionerDaemonRequest struct

+ Organization uuid.UUID

+ PreSharedKey string

+ Provisioners []ProvisionerType

+ Tags map[string]string

+ type ServerSentEvent struct

+ Data interface{}

+ Type ServerSentEventType

+ type ServerSentEventType string

+ const ServerSentEventTypeData

+ const ServerSentEventTypeError

+ const ServerSentEventTypePing

+ type ServiceBannerConfig struct

+ BackgroundColor string

+ Enabled bool

+ Message string

+ type SessionCountDeploymentStats struct

+ JetBrains int64

+ ReconnectingPTY int64

+ SSH int64

+ VSCode int64

+ type SupportConfig struct

+ Links clibase.Struct[[]LinkConfig]

+ type SwaggerConfig struct

+ Enable clibase.Bool

+ type TLSConfig struct

+ Address clibase.HostPort

+ CertFiles clibase.StringArray

+ ClientAuth clibase.String

+ ClientCAFile clibase.String

+ ClientCertFile clibase.String

+ ClientKeyFile clibase.String

+ Enable clibase.Bool

+ KeyFiles clibase.StringArray

+ MinVersion clibase.String

+ RedirectHTTP clibase.Bool

+ type TelemetryConfig struct

+ Enable clibase.Bool

+ Trace clibase.Bool

+ URL clibase.URL

+ type Template struct

+ ActiveUserCount int

+ ActiveVersionID uuid.UUID

+ AllowUserAutostart bool

+ AllowUserAutostop bool

+ AllowUserCancelWorkspaceJobs bool

+ BuildTimeStats TemplateBuildTimeStats

+ CreatedAt time.Time

+ CreatedByID uuid.UUID

+ CreatedByName string

+ DefaultTTLMillis int64

+ Description string

+ DisplayName string

+ FailureTTLMillis int64

+ ID uuid.UUID

+ Icon string

+ InactivityTTLMillis int64

+ LockedTTLMillis int64

+ MaxTTLMillis int64

+ Name string

+ OrganizationID uuid.UUID

+ Provisioner ProvisionerType

+ RestartRequirement TemplateRestartRequirement

+ UpdatedAt time.Time

+ type TemplateACL struct

+ Groups []TemplateGroup

+ Users []TemplateUser

+ type TemplateAppUsage struct

+ DisplayName string

+ Icon string

+ Seconds int64

+ Slug string

+ TemplateIDs []uuid.UUID

+ Type TemplateAppsType

+ type TemplateAppsType string

+ const TemplateAppsTypeApp

+ const TemplateAppsTypeBuiltin

+ type TemplateBuildTimeStats map[WorkspaceTransition]TransitionStats

+ type TemplateExample struct

+ Description string

+ ID string

+ Icon string

+ Markdown string

+ Name string

+ Tags []string

+ URL string

+ type TemplateGroup struct

+ Role TemplateRole

+ type TemplateInsightsIntervalReport struct

+ ActiveUsers int64

+ EndTime time.Time

+ Interval InsightsReportInterval

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type TemplateInsightsReport struct

+ ActiveUsers int64

+ AppsUsage []TemplateAppUsage

+ EndTime time.Time

+ ParametersUsage []TemplateParameterUsage

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type TemplateInsightsRequest struct

+ EndTime time.Time

+ Interval InsightsReportInterval

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type TemplateInsightsResponse struct

+ IntervalReports []TemplateInsightsIntervalReport

+ Report TemplateInsightsReport

+ type TemplateParameterUsage struct

+ Description string

+ DisplayName string

+ Name string

+ Options []TemplateVersionParameterOption

+ TemplateIDs []uuid.UUID

+ Type string

+ Values []TemplateParameterValue

+ type TemplateParameterValue struct

+ Count int64

+ Value string

+ type TemplateRestartRequirement struct

+ DaysOfWeek []string

+ Weeks int64

+ type TemplateRole string

+ const TemplateRoleAdmin

+ const TemplateRoleDeleted

+ const TemplateRoleUse

+ type TemplateUser struct

+ Role TemplateRole

+ type TemplateVersion struct

+ CreatedAt time.Time

+ CreatedBy MinimalUser

+ ID uuid.UUID

+ Job ProvisionerJob

+ Message string

+ Name string

+ OrganizationID uuid.UUID

+ Readme string

+ TemplateID *uuid.UUID

+ UpdatedAt time.Time

+ Warnings []TemplateVersionWarning

+ type TemplateVersionGitAuth struct

+ AuthenticateURL string

+ Authenticated bool

+ ID string

+ Type GitProvider

+ type TemplateVersionParameter struct

+ DefaultValue string

+ Description string

+ DescriptionPlaintext string

+ DisplayName string

+ Ephemeral bool

+ Icon string

+ Mutable bool

+ Name string

+ Options []TemplateVersionParameterOption

+ Required bool

+ Type string

+ ValidationError string

+ ValidationMax *int32

+ ValidationMin *int32

+ ValidationMonotonic ValidationMonotonicOrder

+ ValidationRegex string

+ type TemplateVersionParameterOption struct

+ Description string

+ Icon string

+ Name string

+ Value string

+ type TemplateVersionVariable struct

+ DefaultValue string

+ Description string

+ Name string

+ Required bool

+ Sensitive bool

+ Type string

+ Value string

+ type TemplateVersionWarning string

+ const TemplateVersionWarningUnsupportedWorkspaces

+ type TemplateVersionsByTemplateRequest struct

+ TemplateID uuid.UUID

+ type TokenConfig struct

+ MaxTokenLifetime time.Duration

+ type TokensFilter struct

+ IncludeAll bool

+ type TraceConfig struct

+ CaptureLogs clibase.Bool

+ Enable clibase.Bool

+ HoneycombAPIKey clibase.String

+ type TransitionStats struct

+ P50 *int64

+ P95 *int64

+ type UpdateActiveTemplateVersion struct

+ ID uuid.UUID

+ type UpdateAppearanceConfig struct

+ LogoURL string

+ ServiceBanner ServiceBannerConfig

+ type UpdateCheckResponse struct

+ Current bool

+ URL string

+ Version string

+ type UpdateRoles struct

+ Roles []string

+ type UpdateTemplateACL struct

+ GroupPerms map[string]TemplateRole

+ UserPerms map[string]TemplateRole

+ type UpdateTemplateMeta struct

+ AllowUserAutostart bool

+ AllowUserAutostop bool

+ AllowUserCancelWorkspaceJobs bool

+ DefaultTTLMillis int64

+ Description string

+ DisplayName string

+ FailureTTLMillis int64

+ Icon string

+ InactivityTTLMillis int64

+ LockedTTLMillis int64

+ MaxTTLMillis int64

+ Name string

+ RestartRequirement *TemplateRestartRequirement

+ type UpdateUserPasswordRequest struct

+ OldPassword string

+ Password string

+ type UpdateUserProfileRequest struct

+ Username string

+ type UpdateUserQuietHoursScheduleRequest struct

+ Schedule string

+ type UpdateWorkspaceAutostartRequest struct

+ Schedule *string

+ type UpdateWorkspaceLock struct

+ Lock bool

+ type UpdateWorkspaceProxyResponse struct

+ Proxy WorkspaceProxy

+ ProxyToken string

+ type UpdateWorkspaceRequest struct

+ Name string

+ type UpdateWorkspaceTTLRequest struct

+ TTLMillis *int64

+ type UploadResponse struct

+ ID uuid.UUID

+ type User struct

+ AvatarURL string

+ CreatedAt time.Time

+ Email string

+ ID uuid.UUID

+ LastSeenAt time.Time

+ LoginType LoginType

+ OrganizationIDs []uuid.UUID

+ Roles []Role

+ Status UserStatus

+ Username string

+ type UserLatency struct

+ AvatarURL string

+ LatencyMS ConnectionLatency

+ TemplateIDs []uuid.UUID

+ UserID uuid.UUID

+ Username string

+ type UserLatencyInsightsReport struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ Users []UserLatency

+ type UserLatencyInsightsRequest struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type UserLatencyInsightsResponse struct

+ Report UserLatencyInsightsReport

+ type UserLoginType struct

+ LoginType LoginType

+ type UserQuietHoursScheduleConfig struct

+ DefaultSchedule clibase.String

+ type UserQuietHoursScheduleResponse struct

+ Next time.Time

+ RawSchedule string

+ Time string

+ Timezone string

+ UserSet bool

+ type UserRoles struct

+ OrganizationRoles map[uuid.UUID][]string

+ Roles []string

+ type UserStatus string

+ const UserStatusActive

+ const UserStatusDormant

+ const UserStatusSuspended

+ type UsersRequest struct

+ Role string

+ Search string

+ SearchQuery string

+ Status UserStatus

+ type ValidationError struct

+ Detail string

+ Field string

+ func (e ValidationError) Error() string

+ type ValidationMonotonicOrder string

+ const MonotonicOrderDecreasing

+ const MonotonicOrderIncreasing

+ type VariableValue struct

+ Name string

+ Value string

+ type Workspace struct

+ AutostartSchedule *string

+ CreatedAt time.Time

+ DeletingAt *time.Time

+ Health WorkspaceHealth

+ ID uuid.UUID

+ LastUsedAt time.Time

+ LatestBuild WorkspaceBuild

+ LockedAt *time.Time

+ Name string

+ OrganizationID uuid.UUID

+ Outdated bool

+ OwnerID uuid.UUID

+ OwnerName string

+ TTLMillis *int64

+ TemplateAllowUserCancelWorkspaceJobs bool

+ TemplateDisplayName string

+ TemplateID uuid.UUID

+ TemplateIcon string

+ TemplateName string

+ UpdatedAt time.Time

+ func (w Workspace) FullName() string

+ type WorkspaceAgent struct

+ Apps []WorkspaceApp

+ Architecture string

+ ConnectionTimeoutSeconds int32

+ CreatedAt time.Time

+ DERPLatency map[string]DERPRegion

+ Directory string

+ DisconnectedAt *time.Time

+ EnvironmentVariables map[string]string

+ ExpandedDirectory string

+ FirstConnectedAt *time.Time

+ Health WorkspaceAgentHealth

+ ID uuid.UUID

+ InstanceID string

+ LastConnectedAt *time.Time

+ LifecycleState WorkspaceAgentLifecycle

+ LoginBeforeReady bool

+ LogsLength int32

+ LogsOverflowed bool

+ Name string

+ OperatingSystem string

+ ReadyAt *time.Time

+ ResourceID uuid.UUID

+ ShutdownScript string

+ ShutdownScriptTimeoutSeconds int32

+ StartedAt *time.Time

+ StartupScript string

+ StartupScriptBehavior WorkspaceAgentStartupScriptBehavior

+ StartupScriptTimeoutSeconds int32

+ Status WorkspaceAgentStatus

+ Subsystems []AgentSubsystem

+ TroubleshootingURL string

+ UpdatedAt time.Time

+ Version string

+ type WorkspaceAgentConn struct

+ func NewWorkspaceAgentConn(conn *tailnet.Conn, opts WorkspaceAgentConnOptions) *WorkspaceAgentConn

+ func (c *WorkspaceAgentConn) AwaitReachable(ctx context.Context) bool

+ func (c *WorkspaceAgentConn) Close() error

+ func (c *WorkspaceAgentConn) DialContext(ctx context.Context, network string, addr string) (net.Conn, error)

+ func (c *WorkspaceAgentConn) ListeningPorts(ctx context.Context) (WorkspaceAgentListeningPortsResponse, error)

+ func (c *WorkspaceAgentConn) Ping(ctx context.Context) (time.Duration, bool, *ipnstate.PingResult, error)

+ func (c *WorkspaceAgentConn) ReconnectingPTY(ctx context.Context, id uuid.UUID, height, width uint16, command string) (net.Conn, error)

+ func (c *WorkspaceAgentConn) SSH(ctx context.Context) (net.Conn, error)

+ func (c *WorkspaceAgentConn) SSHClient(ctx context.Context) (*ssh.Client, error)

+ func (c *WorkspaceAgentConn) Speedtest(ctx context.Context, direction speedtest.Direction, duration time.Duration) ([]speedtest.Result, error)

+ type WorkspaceAgentConnOptions struct

+ AgentID uuid.UUID

+ AgentIP netip.Addr

+ CloseFunc func() error

+ type WorkspaceAgentConnectionInfo struct

+ DERPMap *tailcfg.DERPMap

+ DisableDirectConnections bool

+ type WorkspaceAgentHealth struct

+ Healthy bool

+ Reason string

+ type WorkspaceAgentLifecycle string

+ const WorkspaceAgentLifecycleCreated

+ const WorkspaceAgentLifecycleOff

+ const WorkspaceAgentLifecycleReady

+ const WorkspaceAgentLifecycleShutdownError

+ const WorkspaceAgentLifecycleShutdownTimeout

+ const WorkspaceAgentLifecycleShuttingDown

+ const WorkspaceAgentLifecycleStartError

+ const WorkspaceAgentLifecycleStartTimeout

+ const WorkspaceAgentLifecycleStarting

+ func (l WorkspaceAgentLifecycle) ShuttingDown() bool

+ func (l WorkspaceAgentLifecycle) Starting() bool

+ type WorkspaceAgentListeningPort struct

+ Network string

+ Port uint16

+ ProcessName string

+ type WorkspaceAgentListeningPortsResponse struct

+ Ports []WorkspaceAgentListeningPort

+ type WorkspaceAgentLog struct

+ CreatedAt time.Time

+ ID int64

+ Level LogLevel

+ Output string

+ type WorkspaceAgentLogSource string

+ const WorkspaceAgentLogSourceEnvbox

+ const WorkspaceAgentLogSourceEnvbuilder

+ const WorkspaceAgentLogSourceExternal

+ const WorkspaceAgentLogSourceKubernetes

+ const WorkspaceAgentLogSourceShutdownScript

+ const WorkspaceAgentLogSourceStartupScript

+ type WorkspaceAgentMetadata struct

+ Description WorkspaceAgentMetadataDescription

+ Result WorkspaceAgentMetadataResult

+ type WorkspaceAgentMetadataDescription struct

+ DisplayName string

+ Interval int64

+ Key string

+ Script string

+ Timeout int64

+ type WorkspaceAgentMetadataResult struct

+ Age int64

+ CollectedAt time.Time

+ Error string

+ Value string

+ type WorkspaceAgentReconnectingPTYInit struct

+ Command string

+ Height uint16

+ ID uuid.UUID

+ Width uint16

+ type WorkspaceAgentReconnectingPTYOpts struct

+ AgentID uuid.UUID

+ Command string

+ Height uint16

+ Reconnect uuid.UUID

+ SignedToken string

+ Width uint16

+ type WorkspaceAgentStartupScriptBehavior string

+ const WorkspaceAgentStartupScriptBehaviorBlocking

+ const WorkspaceAgentStartupScriptBehaviorNonBlocking

+ type WorkspaceAgentStatus string

+ const WorkspaceAgentConnected

+ const WorkspaceAgentConnecting

+ const WorkspaceAgentDisconnected

+ const WorkspaceAgentTimeout

+ type WorkspaceApp struct

+ Command string

+ DisplayName string

+ External bool

+ Health WorkspaceAppHealth

+ Healthcheck Healthcheck

+ ID uuid.UUID

+ Icon string

+ SharingLevel WorkspaceAppSharingLevel

+ Slug string

+ Subdomain bool

+ URL string

+ type WorkspaceAppHealth string

+ const WorkspaceAppHealthDisabled

+ const WorkspaceAppHealthHealthy

+ const WorkspaceAppHealthInitializing

+ const WorkspaceAppHealthUnhealthy

+ type WorkspaceAppSharingLevel string

+ const WorkspaceAppSharingLevelAuthenticated

+ const WorkspaceAppSharingLevelOwner

+ const WorkspaceAppSharingLevelPublic

+ type WorkspaceBuild struct

+ BuildNumber int32

+ CreatedAt time.Time

+ DailyCost int32

+ Deadline NullTime

+ ID uuid.UUID

+ InitiatorID uuid.UUID

+ InitiatorUsername string

+ Job ProvisionerJob

+ MaxDeadline NullTime

+ Reason BuildReason

+ Resources []WorkspaceResource

+ Status WorkspaceStatus

+ TemplateVersionID uuid.UUID

+ TemplateVersionName string

+ Transition WorkspaceTransition

+ UpdatedAt time.Time

+ WorkspaceID uuid.UUID

+ WorkspaceName string

+ WorkspaceOwnerID uuid.UUID

+ WorkspaceOwnerName string

+ type WorkspaceBuildParameter struct

+ Name string

+ Value string

+ type WorkspaceBuildsRequest struct

+ Since time.Time

+ WorkspaceID uuid.UUID

+ type WorkspaceConnectionLatencyMS struct

+ P50 float64

+ P95 float64

+ type WorkspaceDeploymentStats struct

+ Building int64

+ ConnectionLatencyMS WorkspaceConnectionLatencyMS

+ Failed int64

+ Pending int64

+ Running int64

+ RxBytes int64

+ Stopped int64

+ TxBytes int64

+ type WorkspaceFilter struct

+ FilterQuery string

+ Limit int

+ Name string

+ Offset int

+ Owner string

+ Status string

+ Template string

+ type WorkspaceHealth struct

+ FailingAgents []uuid.UUID

+ Healthy bool

+ type WorkspaceOptions struct

+ IncludeDeleted bool

+ type WorkspaceProxy struct

+ CreatedAt time.Time

+ Deleted bool

+ DerpEnabled bool

+ DerpOnly bool

+ Status WorkspaceProxyStatus

+ UpdatedAt time.Time

+ type WorkspaceProxyBuildInfo struct

+ DashboardURL string

+ WorkspaceProxy bool

+ type WorkspaceProxyStatus struct

+ CheckedAt time.Time

+ Report ProxyHealthReport

+ Status ProxyHealthStatus

+ type WorkspaceQuota struct

+ Budget int

+ CreditsConsumed int

+ type WorkspaceResource struct

+ Agents []WorkspaceAgent

+ CreatedAt time.Time

+ DailyCost int32

+ Hide bool

+ ID uuid.UUID

+ Icon string

+ JobID uuid.UUID

+ Metadata []WorkspaceResourceMetadata

+ Name string

+ Transition WorkspaceTransition

+ Type string

+ type WorkspaceResourceMetadata struct

+ Key string

+ Sensitive bool

+ Value string

+ type WorkspaceStatus string

+ const WorkspaceStatusCanceled

+ const WorkspaceStatusCanceling

+ const WorkspaceStatusDeleted

+ const WorkspaceStatusDeleting

+ const WorkspaceStatusFailed

+ const WorkspaceStatusPending

+ const WorkspaceStatusRunning

+ const WorkspaceStatusStarting

+ const WorkspaceStatusStopped

+ const WorkspaceStatusStopping

+ type WorkspaceTransition string

+ const WorkspaceTransitionDelete

+ const WorkspaceTransitionStart

+ const WorkspaceTransitionStop

+ type WorkspacesRequest struct

+ SearchQuery string

+ type WorkspacesResponse struct

+ Count int

+ Workspaces []Workspace