database

Aug 4, 2026

Changes in this version

+ const LockIDChatModelConfigWrites

type AIBridgeInterception

+ ErrorMessage sql.NullString

+ ErrorType NullAIBridgeInterceptionErrorType

+ type AIBridgeInterceptionErrorType string

+ const AibridgeInterceptionErrorTypeBadRequest

+ const AibridgeInterceptionErrorTypeOverloaded

+ const AibridgeInterceptionErrorTypeRateLimited

+ const AibridgeInterceptionErrorTypeServerError

+ const AibridgeInterceptionErrorTypeTimeout

+ const AibridgeInterceptionErrorTypeUnauthorized

+ const AibridgeInterceptionErrorTypeUnknown

+ func AllAIBridgeInterceptionErrorTypeValues() []AIBridgeInterceptionErrorType

+ func (e *AIBridgeInterceptionErrorType) Scan(src interface{}) error

+ func (e AIBridgeInterceptionErrorType) Valid() bool

type AIBridgeToolUsage

+ ProviderItemID sql.NullString

type AIProvider

+ Icon string

+ type AIUserDailySpend struct

+ Day time.Time

+ EffectiveGroupID uuid.UUID

+ SpendMicros int64

+ UserID uuid.UUID

type APIKeyScope

+ const ApiKeyScopeWorkspaceBuildOrchestration

+ const ApiKeyScopeWorkspaceBuildOrchestrationCreate

+ const ApiKeyScopeWorkspaceBuildOrchestrationDelete

+ const ApiKeyScopeWorkspaceBuildOrchestrationRead

+ const ApiKeyScopeWorkspaceBuildOrchestrationUpdate

type AutoArchiveInactiveChatsRow

+ CompactionRequestedAt sql.NullTime

+ LastReasoningEffort NullChatReasoningEffort

+ Summary sql.NullString

+ SummaryGeneratedAt sql.NullTime

type Chat

+ CompactionRequestedAt sql.NullTime

+ LastReasoningEffort NullChatReasoningEffort

+ Summary sql.NullString

+ SummaryGeneratedAt sql.NullTime

type ChatMessage

+ ReasoningEffort NullChatReasoningEffort

+ SearchTsv interface{}

type ChatQueuedMessage

+ ReasoningEffort NullChatReasoningEffort

+ type ChatReasoningEffort string

+ const ChatReasoningEffortHigh

+ const ChatReasoningEffortLow

+ const ChatReasoningEffortMax

+ const ChatReasoningEffortMedium

+ const ChatReasoningEffortMinimal

+ const ChatReasoningEffortNone

+ const ChatReasoningEffortXhigh

+ func AllChatReasoningEffortValues() []ChatReasoningEffort

+ func (e *ChatReasoningEffort) Scan(src interface{}) error

+ func (e ChatReasoningEffort) Valid() bool

type ChatTable

+ CompactionRequestedAt sql.NullTime

+ LastReasoningEffort NullChatReasoningEffort

+ Summary sql.NullString

+ SummaryGeneratedAt sql.NullTime

type CheckConstraint

+ const CheckAIUserDailySpendSpendMicrosCheck

+ const CheckUserSecretsEnabledRequiresTarget

+ const CheckWorkspaceBuildOrchestrationsAttemptCountCheck

+ const CheckWorkspaceBuildOrchestrationsChildLogLevelCheck

+ const CheckWorkspaceBuildOrchestrationsChildParametersCheck

+ const CheckWorkspaceBuildOrchestrationsChildPresetVersionCheck

+ const CheckWorkspaceBuildOrchestrationsCompletedChildCheck

+ const CheckWorkspaceBuildOrchestrationsNextRetryAfterCheck

+ const CheckWorkspaceBuildOrchestrationsStatusCheck

type CreateUserSecretParams

+ Enabled bool

+ type DeleteOldWorkspaceBuildOrchestrationsParams struct

+ BeforeTime time.Time

+ LimitCount int32

+ type ExportOrganizationAISpendParams struct

+ OrganizationID uuid.UUID

+ PeriodEnd time.Time

+ PeriodStart time.Time

+ type ExportOrganizationAISpendRow struct

+ CacheReadTokens int64

+ CacheWriteTokens int64

+ CostMicros int64

+ GroupID uuid.NullUUID

+ GroupName string

+ InputTokens int64

+ Model string

+ OrganizationID uuid.UUID

+ OrganizationName string

+ OutputTokens int64

+ Provider string

+ ProviderName string

+ UserID uuid.UUID

+ Username string

+ func (r ExportOrganizationAISpendRow) RBACObject() rbac.Object

type ForeignKeyConstraint

+ const ForeignKeyWorkspaceBuildOrchestrationsChildBuildWorkspaceID

+ const ForeignKeyWorkspaceBuildOrchestrationsChildPresetID

+ const ForeignKeyWorkspaceBuildOrchestrationsChildPresetVersion

+ const ForeignKeyWorkspaceBuildOrchestrationsChildTemplateVersionID

+ const ForeignKeyWorkspaceBuildOrchestrationsParentBuildWorkspaceID

+ type GetAIBridgeSessionTopDomainsParams struct

+ Limit int32

+ SessionID string

+ type GetAIBridgeSessionTopDomainsRow struct

+ Count int64

+ Domain string

+ TotalDomains int64

+ type GetActiveUsersAuthorizationRolesRow struct

+ Groups []string

+ ID uuid.UUID

+ Roles []string

+ func (r GetActiveUsersAuthorizationRolesRow) RoleNames() ([]rbac.RoleIdentifier, error)

type GetAutoArchiveInactiveChatCandidatesRow

+ CompactionRequestedAt sql.NullTime

+ LastReasoningEffort NullChatReasoningEffort

+ Summary sql.NullString

+ SummaryGeneratedAt sql.NullTime

type GetChatCostSummaryRow

+ UnpricedMessagesHavingUsageCount int64

+ type GetChatFileDataPrefixesByIDsParams struct

+ IDs []uuid.UUID

+ PrefixBytes int32

+ type GetChatFileDataPrefixesByIDsRow struct

+ DataPrefix []byte

+ ID uuid.UUID

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ func (c GetChatFileDataPrefixesByIDsRow) RBACObject() rbac.Object

+ type GetChatGatewayAPIKeyParams struct

+ TokenName string

+ UserID uuid.UUID

+ type GetChatModelUsageCostByChatIDRow struct

+ ChatID uuid.UUID

+ PricedMessageCount int64

+ TotalCostMicros int64

+ UnpricedMessagesHavingUsageCount int64

type GetChatWorkerAcquisitionCandidatesRow

+ CompactionRequestedAt sql.NullTime

+ LastReasoningEffort NullChatReasoningEffort

+ Summary sql.NullString

+ SummaryGeneratedAt sql.NullTime

type GetChatsParams

+ Search string

+ type GetGroupMembersAISpendParams struct

+ GroupID uuid.UUID

+ PeriodStart time.Time

+ UserIds []uuid.UUID

+ type GetGroupMembersAISpendRow struct

+ EffectiveGroupID uuid.NullUUID

+ GroupSpendMicros int64

+ LimitSource sql.NullString

+ OrganizationID uuid.UUID

+ SpendLimitMicros sql.NullInt64

+ UserID uuid.UUID

+ func (r GetGroupMembersAISpendRow) RBACObject() rbac.Object

+ type GetOrganizationGroupsAISpendParams struct

+ GroupIds []uuid.UUID

+ OrganizationID uuid.UUID

+ PeriodStart time.Time

+ type GetOrganizationGroupsAISpendRow struct

+ CurrentSpendMicros int64

+ GroupID uuid.UUID

+ OrganizationID uuid.UUID

+ SpendLimitMicros sql.NullInt64

+ TotalSpendLimitMicros sql.NullInt64

+ func (g GetOrganizationGroupsAISpendRow) RBACObject() rbac.Object

+ type GetOverBudgetUsersPerGroupRow struct

+ GroupID uuid.UUID

+ OverBudgetUsers int64

+ type GetUserAISpendSinceParams struct

+ EffectiveGroupID uuid.UUID

+ PeriodStart time.Time

+ UserID uuid.UUID

+ type GetUserAISpendSinceRow struct

+ EffectiveGroupID uuid.UUID

+ PeriodStart time.Time

+ SpendMicros int64

+ UserID uuid.UUID

+ type GetWorkspaceAgentsInLatestBuildByWorkspaceIDsRow struct

+ WorkspaceAgent WorkspaceAgent

+ WorkspaceID uuid.UUID

+ type IncrementUserAIDailySpendParams struct

+ CostMicros int64

+ Day time.Time

+ EffectiveGroupID uuid.UUID

+ UserID uuid.UUID

type InsertAIBridgeToolUsageParams

+ ProviderItemID sql.NullString

type InsertAIProviderParams

+ Icon string

type InsertChatMessagesParams

+ ReasoningEffort []string

type InsertChatQueuedMessageParams

+ ReasoningEffort NullChatReasoningEffort

type InsertChatQueuedMessageWithCreatorParams

+ ReasoningEffort NullChatReasoningEffort

type InsertMCPServerConfigParams

+ OAuth2RevocationURL string

+ type InsertWorkspaceBuildOrchestrationParams struct

+ ChildLogLevel string

+ ChildReason NullBuildReason

+ ChildRichParameterValues json.RawMessage

+ ChildTemplateVersionID uuid.NullUUID

+ ChildTemplateVersionPresetID uuid.NullUUID

+ ChildTransition WorkspaceTransition

+ CreatedAt time.Time

+ ID uuid.UUID

+ ParentBuildID uuid.UUID

+ UpdatedAt time.Time

+ type ListAIBridgeSessionNetworkCallsParams struct

+ Limit int32

+ SessionID string

type ListAIBridgeSessionsRow

+ FirewallActive bool

+ NetworkCallsBlocked int64

+ NetworkCallsTotal int64

type ListUserSecretsRow

+ Enabled bool

type MCPServerConfig

+ OAuth2RevocationURL string

type MCPServerUserToken

+ OauthRefreshFailureReason string

+ type MarkMCPServerUserTokenRefreshFailureParams struct

+ ID uuid.UUID

+ OauthRefreshFailureReason string

+ UpdatedAt time.Time

+ type NullAIBridgeInterceptionErrorType struct

+ AIBridgeInterceptionErrorType AIBridgeInterceptionErrorType

+ Valid bool

+ func (ns *NullAIBridgeInterceptionErrorType) Scan(value interface{}) error

+ func (ns NullAIBridgeInterceptionErrorType) Value() (driver.Value, error)

+ type NullChatReasoningEffort struct

+ ChatReasoningEffort ChatReasoningEffort

+ Valid bool

+ func (ns *NullChatReasoningEffort) Scan(value interface{}) error

+ func (ns NullChatReasoningEffort) Value() (driver.Value, error)

type UniqueConstraint

+ const UniqueAIUserDailySpendPkey

+ const UniqueTemplateVersionPresetsIDTemplateVersionIDKey

+ const UniqueWorkspaceBuildOrchestrationsChildBuildIDKey

+ const UniqueWorkspaceBuildOrchestrationsParentBuildIDKey

+ const UniqueWorkspaceBuildOrchestrationsPkey

+ const UniqueWorkspaceBuildsIDWorkspaceIDKey

type UpdateAIBridgeInterceptionEndedParams

+ ErrorMessage sql.NullString

+ ErrorType NullAIBridgeInterceptionErrorType

type UpdateAIProviderParams

+ Icon string

type UpdateChatExecutionStateParams

+ CompactionRequestedAt sql.NullTime

+ type UpdateChatSummaryParams struct

+ ExpectedHistoryVersion int64

+ ID uuid.UUID

+ Summary sql.NullString

type UpdateMCPServerConfigParams

+ OAuth2RevocationURL string

+ type UpdateMCPServerUserTokenFromRefreshParams struct

+ AccessToken string

+ AccessTokenKeyID sql.NullString

+ Expiry sql.NullTime

+ ID uuid.UUID

+ RefreshToken string

+ RefreshTokenKeyID sql.NullString

+ TokenType string

+ UpdatedAt time.Time

type UpdateUserSecretByUserIDAndNameParams

+ Enabled bool

+ UpdateEnabled bool

+ type UpdateWorkspaceBuildOrchestrationCanceledByIDParams struct

+ ID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateWorkspaceBuildOrchestrationCompletedByIDParams struct

+ ChildBuildID uuid.NullUUID

+ ID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateWorkspaceBuildOrchestrationFailedByIDParams struct

+ Error sql.NullString

+ ID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateWorkspaceBuildOrchestrationRetryByIDParams struct

+ Error sql.NullString

+ ID uuid.UUID

+ MaxAttemptCount int32

+ NextRetryAfter time.Time

+ UpdatedAt time.Time

type UserSecret

+ Enabled bool

+ type WorkspaceBuildOrchestration struct

+ AttemptCount int32

+ ChildBuildID uuid.NullUUID

+ ChildLogLevel string

+ ChildReason NullBuildReason

+ ChildRichParameterValues json.RawMessage

+ ChildTemplateVersionID uuid.NullUUID

+ ChildTemplateVersionPresetID uuid.NullUUID

+ ChildTransition WorkspaceTransition

+ CreatedAt time.Time

+ Error sql.NullString

+ ID uuid.UUID

+ NextRetryAfter sql.NullTime

+ ParentBuildID uuid.UUID

+ Status string

+ UpdatedAt time.Time

+ WorkspaceID uuid.UUID

Jul 7, 2026

Changes in this version

type AIBridgeInterception

+ AgentFirewallSequenceNumber sql.NullInt32

+ AgentFirewallSessionID uuid.NullUUID

type AIBridgeTokenUsage

+ CacheReadPriceMicros sql.NullInt64

+ CacheWritePriceMicros sql.NullInt64

+ CostMicros sql.NullInt64

+ EffectiveGroupID uuid.NullUUID

+ InputPriceMicros sql.NullInt64

+ OutputPriceMicros sql.NullInt64

+ type AIGatewayKey struct

+ CreatedAt time.Time

+ HashedSecret []byte

+ ID uuid.UUID

+ LastHeartbeatAt sql.NullTime

+ Name string

+ SecretPrefix string

+ type AIModelPrice struct

+ CacheReadPrice sql.NullInt64

+ CacheWritePrice sql.NullInt64

+ CreatedAt time.Time

+ InputPrice sql.NullInt64

+ Model string

+ OutputPrice sql.NullInt64

+ Provider string

+ UpdatedAt time.Time

type AIProviderType

+ const AIProviderTypeAnthropic

+ const AIProviderTypeAzure

+ const AIProviderTypeBedrock

+ const AIProviderTypeCopilot

+ const AIProviderTypeGoogle

+ const AIProviderTypeOpenai

+ const AIProviderTypeOpenaiCompat

+ const AIProviderTypeOpenrouter

+ const AIProviderTypeVercel

+ type AISeatState struct

+ FirstUsedAt time.Time

+ LastEventDescription string

+ LastEventType AISeatUsageReason

+ LastUsedAt time.Time

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type AISeatUsageReason string

+ const AISeatUsageReasonAibridge

+ const AISeatUsageReasonTask

+ func AllAISeatUsageReasonValues() []AISeatUsageReason

+ func (e *AISeatUsageReason) Scan(src interface{}) error

+ func (e AISeatUsageReason) Valid() bool

type APIKeyScope

+ const ApiKeyScopeAIGatewayKey

+ const ApiKeyScopeAIGatewayKeyCreate

+ const ApiKeyScopeAIGatewayKeyDelete

+ const ApiKeyScopeAIGatewayKeyRead

+ const ApiKeyScopeAIGatewayKeyUpdate

+ const ApiKeyScopeAIModelPrice

+ const ApiKeyScopeAIModelPriceRead

+ const ApiKeyScopeAIModelPriceUpdate

+ const ApiKeyScopeAIProvider

+ const ApiKeyScopeAIProviderCreate

+ const ApiKeyScopeAIProviderDelete

+ const ApiKeyScopeAIProviderRead

+ const ApiKeyScopeAIProviderUpdate

+ const ApiKeyScopeAISeat

+ const ApiKeyScopeAISeatCreate

+ const ApiKeyScopeAISeatRead

+ const ApiKeyScopeBoundaryLog

+ const ApiKeyScopeBoundaryLogCreate

+ const ApiKeyScopeBoundaryLogDelete

+ const ApiKeyScopeBoundaryLogRead

+ type AuditableGroupAIBudget struct

+ GroupName string

+ SpendLimit string

+ type AuditableUserAIBudgetOverride struct

+ GroupName string

+ SpendLimit string

+ Username string

type AutoArchiveInactiveChatsRow

+ ContextAggregateHash []byte

+ ContextDirtyResources pqtype.NullRawMessage

+ ContextDirtySince sql.NullTime

+ ContextError string

+ GenerationAttempt int64

+ HistoryVersion int64

+ QueueVersion int64

+ RequiresActionDeadlineAt sql.NullTime

+ RetryState pqtype.NullRawMessage

+ RetryStateVersion int64

+ RunnerID uuid.NullUUID

+ SnapshotVersion int64

+ type BatchDeleteChatHeartbeatsParams struct

+ ChatIds []uuid.UUID

+ RunnerIds []uuid.UUID

+ type BatchUpsertChatHeartbeatsParams struct

+ ChatIds []uuid.UUID

+ RunnerIds []uuid.UUID

type BoundaryLog

+ OwnerID uuid.NullUUID

type BoundarySession

+ OwnerID uuid.NullUUID

type Chat

+ ContextAggregateHash []byte

+ ContextDirtyResources pqtype.NullRawMessage

+ ContextDirtySince sql.NullTime

+ ContextError string

+ GenerationAttempt int64

+ HistoryVersion int64

+ QueueVersion int64

+ RequiresActionDeadlineAt sql.NullTime

+ RetryState pqtype.NullRawMessage

+ RetryStateVersion int64

+ RunnerID uuid.NullUUID

+ SnapshotVersion int64

+ type ChatContextResource struct

+ Body json.RawMessage

+ BodyKind WorkspaceAgentContextBodyKind

+ ChatID uuid.UUID

+ ContentHash []byte

+ CreatedAt time.Time

+ Error string

+ SizeBytes int64

+ Source string

+ SourcePath string

+ Status WorkspaceAgentContextResourceStatus

+ UpdatedAt time.Time

+ type ChatHeartbeat struct

+ ChatID uuid.UUID

+ HeartbeatAt time.Time

+ RunnerID uuid.UUID

type ChatMessage

+ Revision int64

type ChatQueuedMessage

+ CreatedBy uuid.UUID

+ Position int64

type ChatStatus

+ const ChatStatusInterrupting

type ChatTable

+ ContextAggregateHash []byte

+ ContextDirtyResources pqtype.NullRawMessage

+ ContextDirtySince sql.NullTime

+ ContextError string

+ GenerationAttempt int64

+ HistoryVersion int64

+ QueueVersion int64

+ RequiresActionDeadlineAt sql.NullTime

+ RetryState pqtype.NullRawMessage

+ RetryStateVersion int64

+ RunnerID uuid.NullUUID

+ SnapshotVersion int64

type CheckConstraint

+ const CheckAIGatewayKeysHashedSecretCheck

+ const CheckAIGatewayKeysNameCheck

+ const CheckAIGatewayKeysSecretPrefixCheck

+ const CheckAIModelPricesCacheReadPriceCheck

+ const CheckAIModelPricesCacheWritePriceCheck

+ const CheckAIModelPricesInputPriceCheck

+ const CheckAIModelPricesOutputPriceCheck

+ const CheckAIProvidersNameCheck

+ const CheckAibridgeTokenUsagesCacheReadPriceMicrosCheck

+ const CheckAibridgeTokenUsagesCacheWritePriceMicrosCheck

+ const CheckAibridgeTokenUsagesCostMicrosCheck

+ const CheckAibridgeTokenUsagesInputPriceMicrosCheck

+ const CheckAibridgeTokenUsagesOutputPriceMicrosCheck

+ const CheckChatModelConfigsAIProviderRequiredWhenActive

+ const CheckGroupAIBudgetsSpendLimitMicrosCheck

+ const CheckNatsPortValidTcp

+ const CheckUserAIBudgetOverridesSpendLimitMicrosCheck

+ const CheckUserAIProviderKeysAPIKeyCheck

type CryptoKeyFeature

+ const CryptoKeyFeatureNATSCA

+ type DeleteAIGatewayKeyRow struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ LastHeartbeatAt sql.NullTime

+ Name string

+ SecretPrefix string

+ type DeleteChatQueuedMessageReturningCountParams struct

+ ChatID uuid.UUID

+ ID int64

+ type DeleteOldBoundarySessionsParams struct

+ BeforeTime time.Time

+ LimitCount int32

+ type DeleteStaleWorkspaceAgentContextResourcesParams struct

+ ActiveSources []string

+ WorkspaceAgentID uuid.UUID

type ForeignKeyConstraint

+ const ForeignKeyAIProviderKeysAPIKeyKeyID

+ const ForeignKeyAIProviderKeysProviderID

+ const ForeignKeyAIProvidersSettingsKeyID

+ const ForeignKeyAISeatStateUserID

+ const ForeignKeyBoundaryLogsOwnerID

+ const ForeignKeyBoundarySessionsOwnerID

+ const ForeignKeyChatContextResourcesChatID

+ const ForeignKeyChatHeartbeatsChatID

+ const ForeignKeyChatModelConfigsAIProviderID

+ const ForeignKeyGitSSHKeysPrivateKeyKeyID

+ const ForeignKeyGroupAIBudgetsGroupID

+ const ForeignKeyUserAIBudgetOverridesGroupID

+ const ForeignKeyUserAIBudgetOverridesUserID

+ const ForeignKeyUserAIProviderKeysAIProviderID

+ const ForeignKeyUserAIProviderKeysAPIKeyKeyID

+ const ForeignKeyUserAIProviderKeysUserID

+ const ForeignKeyWorkspaceAgentContextResourcesWorkspaceAgentID

+ const ForeignKeyWorkspaceAgentContextSnapshotsWorkspaceAgentID

+ type GetAutoArchiveInactiveChatCandidatesParams struct

+ ArchiveCutoff time.Time

+ LimitCount int32

+ type GetAutoArchiveInactiveChatCandidatesRow struct

+ AgentID uuid.NullUUID

+ Archived bool

+ BuildID uuid.NullUUID

+ ClientType ChatClientType

+ ContextAggregateHash []byte

+ ContextDirtyResources pqtype.NullRawMessage

+ ContextDirtySince sql.NullTime

+ ContextError string

+ CreatedAt time.Time

+ DynamicTools pqtype.NullRawMessage

+ GenerationAttempt int64

+ GroupACL ChatACL

+ HeartbeatAt sql.NullTime

+ HistoryVersion int64

+ ID uuid.UUID

+ Labels StringMap

+ LastActivityAt time.Time

+ LastError pqtype.NullRawMessage

+ LastModelConfigID uuid.UUID

+ LastReadMessageID sql.NullInt64

+ LastTurnSummary sql.NullString

+ MCPServerIDs []uuid.UUID

+ Mode NullChatMode

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ OwnerName string

+ OwnerUsername string

+ ParentChatID uuid.NullUUID

+ PinOrder int32

+ PlanMode NullChatPlanMode

+ QueueVersion int64

+ RequiresActionDeadlineAt sql.NullTime

+ RetryState pqtype.NullRawMessage

+ RetryStateVersion int64

+ RootChatID uuid.NullUUID

+ RunnerID uuid.NullUUID

+ SnapshotVersion int64

+ StartedAt sql.NullTime

+ Status ChatStatus

+ Title string

+ UpdatedAt time.Time

+ UserACL ChatACL

+ WorkerID uuid.NullUUID

+ WorkspaceID uuid.NullUUID

+ type GetBoundarySessionByIDRow struct

+ ConfinedProcessName string

+ ID uuid.UUID

+ OwnerID uuid.NullUUID

+ StartedAt time.Time

+ UpdatedAt time.Time

+ WorkspaceAgentID uuid.UUID

+ WorkspaceID uuid.UUID

+ WorkspaceOwnerID uuid.UUID

+ type GetChatHeartbeatParams struct

+ ChatID uuid.UUID

+ RunnerID uuid.UUID

+ type GetChatMessagesByRevisionForStreamParams struct

+ AfterRevision int64

+ ChatID uuid.UUID

+ type GetChatQueuedMessageByIDParams struct

+ ChatID uuid.UUID

+ ID int64

+ type GetChatStreamSyncRowsRow struct

+ GenerationAttempt int64

+ HistoryVersion int64

+ ID uuid.UUID

+ QueueVersion int64

+ RetryStateVersion int64

+ SnapshotVersion int64

+ Status ChatStatus

+ WorkerID uuid.NullUUID

+ type GetChatWorkerAcquisitionCandidatesParams struct

+ LimitCount int32

+ StaleSeconds int32

+ type GetChatWorkerAcquisitionCandidatesRow struct

+ AgentID uuid.NullUUID

+ Archived bool

+ BuildID uuid.NullUUID

+ ClientType ChatClientType

+ ContextAggregateHash []byte

+ ContextDirtyResources pqtype.NullRawMessage

+ ContextDirtySince sql.NullTime

+ ContextError string

+ CreatedAt time.Time

+ CurrentHeartbeatAt sql.NullTime

+ DynamicTools pqtype.NullRawMessage

+ GenerationAttempt int64

+ GroupACL ChatACL

+ HeartbeatAt sql.NullTime

+ HeartbeatStale bool

+ HistoryVersion int64

+ ID uuid.UUID

+ Labels StringMap

+ LastError pqtype.NullRawMessage

+ LastModelConfigID uuid.UUID

+ LastReadMessageID sql.NullInt64

+ LastTurnSummary sql.NullString

+ MCPServerIDs []uuid.UUID

+ Mode NullChatMode

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ OwnerName string

+ OwnerUsername string

+ ParentChatID uuid.NullUUID

+ PinOrder int32

+ PlanMode NullChatPlanMode

+ QueueVersion int64

+ RequiresActionDeadlineAt sql.NullTime

+ RetryState pqtype.NullRawMessage

+ RetryStateVersion int64

+ RootChatID uuid.NullUUID

+ RunnerID uuid.NullUUID

+ SnapshotVersion int64

+ StartedAt sql.NullTime

+ Status ChatStatus

+ Title string

+ UpdatedAt time.Time

+ UserACL ChatACL

+ WorkerID uuid.NullUUID

+ WorkspaceID uuid.NullUUID

type GetChatsParams

+ SharedWithGroupIds []string

+ SharedWithUserID uuid.UUID

+ type GetEnabledChatModelConfigsRow struct

+ ChatModelConfig ChatModelConfig

+ Provider string

+ type GetExternalAgentTokensByTemplateIDParams struct

+ OwnerID uuid.UUID

+ TemplateID uuid.UUID

+ type GetExternalAgentTokensByTemplateIDRow struct

+ AgentID uuid.UUID

+ AgentName string

+ AgentToken uuid.UUID

+ WorkspaceID uuid.UUID

+ WorkspaceName string

+ type GetHighestGroupAIBudgetByUserRow struct

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ type GetTemplateRankingSignalsByOwnerIDParams struct

+ LookbackCutoff time.Time

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ PrebuildsUserID uuid.UUID

+ TemplateIDs []uuid.UUID

+ type GetTemplateRankingSignalsByOwnerIDRow struct

+ ActiveCount int64

+ DeletedRecentCount int64

+ LastUsedAt sql.NullTime

+ OrgDevs int64

+ TemplateID uuid.UUID

type GetUsersParams

+ ExactEmail string

+ ExactUsername string

+ type GetWorkspacesEligibleForLifecycleActionRow struct

+ BuildTemplateVersionID uuid.NullUUID

+ ID uuid.UUID

+ Name string

type GitSSHKey

+ PrivateKeyKeyID sql.NullString

+ type GroupAIBudget struct

+ CreatedAt time.Time

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ UpdatedAt time.Time

+ func (b GroupAIBudget) Auditable(groupName string) AuditableGroupAIBudget

+ type HydrateAgentChatsContextParams struct

+ AgentID uuid.UUID

+ AggregateHash []byte

+ ContextError string

type InsertAIBridgeInterceptionParams

+ AgentFirewallSequenceNumber sql.NullInt32

+ AgentFirewallSessionID uuid.NullUUID

type InsertAIBridgeTokenUsageParams

+ CacheReadPriceMicros sql.NullInt64

+ CacheWritePriceMicros sql.NullInt64

+ CostMicros sql.NullInt64

+ EffectiveGroupID uuid.NullUUID

+ InputPriceMicros sql.NullInt64

+ OutputPriceMicros sql.NullInt64

+ type InsertAIGatewayKeyParams struct

+ HashedSecret []byte

+ ID uuid.UUID

+ Name string

+ SecretPrefix string

+ type InsertAIGatewayKeyRow struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Name string

+ SecretPrefix string

+ type InsertAgentContextResourcesIntoChatParams struct

+ AgentID uuid.UUID

+ ChatID uuid.UUID

+ type InsertBoundaryLogsParams struct

+ CapturedAt []time.Time

+ CreatedAt []time.Time

+ Detail []string

+ ID []uuid.UUID

+ MatchedRule []string

+ Method []string

+ OwnerID uuid.UUID

+ Proto []string

+ SequenceNumber []int32

+ SessionID uuid.UUID

type InsertBoundarySessionParams

+ OwnerID uuid.NullUUID

+ type InsertChatQueuedMessageWithCreatorParams struct

+ APIKeyID sql.NullString

+ ChatID uuid.UUID

+ Content json.RawMessage

+ CreatedBy uuid.UUID

+ ModelConfigID uuid.NullUUID

type InsertGitSSHKeyParams

+ PrivateKeyKeyID sql.NullString

type InsertOrganizationParams

+ DefaultOrgMemberRoles []string

type InsertReplicaParams

+ ClusterHost string

+ NATSPort int32

+ type IsChatHeartbeatStaleParams struct

+ ChatID uuid.UUID

+ RunnerID uuid.UUID

+ StaleSeconds int32

+ type ListAIGatewayKeysRow struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ LastHeartbeatAt sql.NullTime

+ Name string

+ SecretPrefix string

+ type MarkChatsContextDirtyByAgentParams struct

+ AgentID uuid.UUID

+ AggregateHash []byte

+ DirtySince sql.NullTime

+ type MarkChatsContextDirtyByAgentRow struct

+ ID uuid.UUID

+ OwnerID uuid.UUID

+ type NullAISeatUsageReason struct

+ AISeatUsageReason AISeatUsageReason

+ Valid bool

+ func (ns *NullAISeatUsageReason) Scan(value interface{}) error

+ func (ns NullAISeatUsageReason) Value() (driver.Value, error)

+ type NullWorkspaceAgentContextBodyKind struct

+ Valid bool

+ WorkspaceAgentContextBodyKind WorkspaceAgentContextBodyKind

+ func (ns *NullWorkspaceAgentContextBodyKind) Scan(value interface{}) error

+ func (ns NullWorkspaceAgentContextBodyKind) Value() (driver.Value, error)

+ type NullWorkspaceAgentContextResourceStatus struct

+ Valid bool

+ WorkspaceAgentContextResourceStatus WorkspaceAgentContextResourceStatus

+ func (ns *NullWorkspaceAgentContextResourceStatus) Scan(value interface{}) error

+ func (ns NullWorkspaceAgentContextResourceStatus) Value() (driver.Value, error)

type Organization

+ DefaultOrgMemberRoles []string

+ type ReorderChatQueuedMessageToHeadParams struct

+ ChatID uuid.UUID

+ ID int64

type Replica

+ ClusterHost string

+ NATSPort int32

type ResourceType

+ const ResourceTypeAIGatewayKey

+ const ResourceTypeAISeat

+ const ResourceTypeGroupAIBudget

+ const ResourceTypeUserAIBudgetOverride

+ type SetChatContextSnapshotParams struct

+ AggregateHash []byte

+ ContextError string

+ ID uuid.UUID

type Template

+ TimeTilAutostopNotify int64

type TemplateTable

+ TimeTilAutostopNotify int64

type UniqueConstraint

+ const UniqueAIGatewayKeysHashedSecretIndex

+ const UniqueAIGatewayKeysNameIndex

+ const UniqueAIGatewayKeysPkey

+ const UniqueAIGatewayKeysSecretPrefixIndex

+ const UniqueAIModelPricesPkey

+ const UniqueAIProviderKeysPkey

+ const UniqueAIProvidersNameUnique

+ const UniqueAIProvidersPkey

+ const UniqueAISeatStatePkey

+ const UniqueChatContextResourcesPkey

+ const UniqueChatHeartbeatsPkey

+ const UniqueGroupAIBudgetsPkey

+ const UniqueUserAIBudgetOverridesPkey

+ const UniqueUserAIProviderKeysPkey

+ const UniqueUserAIProviderKeysUserIDAIProviderIDKey

+ const UniqueWorkspaceAgentContextResourcesPkey

+ const UniqueWorkspaceAgentContextSnapshotsPkey

+ type UpdateChatExecutionStateParams struct

+ Archived bool

+ ID uuid.UUID

+ LastError pqtype.NullRawMessage

+ RequiresActionDeadlineAt sql.NullTime

+ RunnerID uuid.NullUUID

+ Status ChatStatus

+ WorkerID uuid.NullUUID

type UpdateChatLastTurnSummaryParams

+ ExpectedHistoryVersion int64

+ type UpdateChatRetryStateParams struct

+ ID uuid.UUID

+ RetryState json.RawMessage

type UpdateGitSSHKeyParams

+ PrivateKeyKeyID sql.NullString

type UpdateOrganizationParams

+ DefaultOrgMemberRoles []string

type UpdateReplicaParams

+ ClusterHost string

+ NATSPort int32

type UpdateTemplateScheduleByIDParams

+ TimeTilAutostopNotify int64

+ type UpdateWorkspaceBuildNotifiedAutostopDeadlineParams struct

+ ID uuid.UUID

+ NotifiedAutostopDeadline time.Time

+ UpdatedAt time.Time

+ type UpsertChatHeartbeatParams struct

+ ChatID uuid.UUID

+ RunnerID uuid.UUID

+ type UpsertUserAIBudgetOverrideParams struct

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ UserID uuid.UUID

+ type UpsertWorkspaceAgentContextResourceParams struct

+ Body json.RawMessage

+ BodyKind WorkspaceAgentContextBodyKind

+ ContentHash []byte

+ Error string

+ Now time.Time

+ SizeBytes int64

+ Source string

+ SourcePath string

+ Status WorkspaceAgentContextResourceStatus

+ WorkspaceAgentID uuid.UUID

+ type UpsertWorkspaceAgentContextSnapshotParams struct

+ AggregateHash []byte

+ ReceivedAt time.Time

+ SnapshotError string

+ Version int64

+ WorkspaceAgentID uuid.UUID

+ type UserAIBudgetOverride struct

+ CreatedAt time.Time

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ func (o UserAIBudgetOverride) Auditable(username, groupName string) AuditableUserAIBudgetOverride

+ type UserAIProviderKey struct

+ AIProviderID uuid.UUID

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ CreatedAt time.Time

+ ID uuid.UUID

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type WorkspaceAgentContextBodyKind string

+ const WorkspaceAgentContextBodyKindCommand

+ const WorkspaceAgentContextBodyKindHook

+ const WorkspaceAgentContextBodyKindInstructionFile

+ const WorkspaceAgentContextBodyKindMcpConfig

+ const WorkspaceAgentContextBodyKindMcpServer

+ const WorkspaceAgentContextBodyKindPlugin

+ const WorkspaceAgentContextBodyKindSkill

+ const WorkspaceAgentContextBodyKindSubagent

+ func AllWorkspaceAgentContextBodyKindValues() []WorkspaceAgentContextBodyKind

+ func (e *WorkspaceAgentContextBodyKind) Scan(src interface{}) error

+ func (e WorkspaceAgentContextBodyKind) Valid() bool

+ type WorkspaceAgentContextResource struct

+ Body json.RawMessage

+ BodyKind WorkspaceAgentContextBodyKind

+ ContentHash []byte

+ CreatedAt time.Time

+ Error string

+ SizeBytes int64

+ Source string

+ SourcePath string

+ Status WorkspaceAgentContextResourceStatus

+ UpdatedAt time.Time

+ WorkspaceAgentID uuid.UUID

+ type WorkspaceAgentContextResourceStatus string

+ const WorkspaceAgentContextResourceStatusExcluded

+ const WorkspaceAgentContextResourceStatusInvalid

+ const WorkspaceAgentContextResourceStatusOk

+ const WorkspaceAgentContextResourceStatusOversize

+ const WorkspaceAgentContextResourceStatusUnreadable

+ func AllWorkspaceAgentContextResourceStatusValues() []WorkspaceAgentContextResourceStatus

+ func (e *WorkspaceAgentContextResourceStatus) Scan(src interface{}) error

+ func (e WorkspaceAgentContextResourceStatus) Valid() bool

+ type WorkspaceAgentContextSnapshot struct

+ AggregateHash []byte

+ ReceivedAt time.Time

+ SnapshotError string

+ Version int64

+ WorkspaceAgentID uuid.UUID

type WorkspaceBuild

+ NotifiedAutostopDeadline time.Time

type WorkspaceBuildTable

+ NotifiedAutostopDeadline time.Time

Aug 10, 2026

Changes in this version

+ type HasTemplateVersionsUsingCachedModuleFileInOrgParams struct

+ FileID uuid.UUID

+ OrganizationID uuid.UUID

Jun 17, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Changes in this version

+ type BackfillChatModelConfigProviderParams struct

+ NewProvider string

+ OldProvider string

type UpdateAIProviderParams

+ Type AIProviderType

Jun 11, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 8, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 2, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LockIDAIProvidersEnvSeed

+ type AIProvider struct

+ BaseUrl string

+ CreatedAt time.Time

+ Deleted bool

+ DisplayName sql.NullString

+ Enabled bool

+ ID uuid.UUID

+ Name string

+ Settings sql.NullString

+ SettingsKeyID sql.NullString

+ Type AIProviderType

+ UpdatedAt time.Time

+ type AIProviderKey struct

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ CreatedAt time.Time

+ ID uuid.UUID

+ ProviderID uuid.UUID

+ UpdatedAt time.Time

+ type AIProviderType string

+ const AiProviderTypeAnthropic

+ const AiProviderTypeAzure

+ const AiProviderTypeBedrock

+ const AiProviderTypeCopilot

+ const AiProviderTypeGoogle

+ const AiProviderTypeOpenai

+ const AiProviderTypeOpenaiCompat

+ const AiProviderTypeOpenrouter

+ const AiProviderTypeVercel

+ func AllAIProviderTypeValues() []AIProviderType

+ func (e *AIProviderType) Scan(src interface{}) error

+ func (e AIProviderType) Valid() bool

type APIKeyScope

+ const ApiKeyScopeAiModelPrice

+ const ApiKeyScopeAiModelPriceRead

+ const ApiKeyScopeAiModelPriceUpdate

+ const ApiKeyScopeAiProvider

+ const ApiKeyScopeAiProviderCreate

+ const ApiKeyScopeAiProviderDelete

+ const ApiKeyScopeAiProviderRead

+ const ApiKeyScopeAiProviderUpdate

+ const ApiKeyScopeChatShare

+ const ApiKeyScopeUserSkill

+ const ApiKeyScopeUserSkillCreate

+ const ApiKeyScopeUserSkillDelete

+ const ApiKeyScopeUserSkillRead

+ const ApiKeyScopeUserSkillUpdate

+ type AiModelPrice struct

+ CacheReadPrice sql.NullInt64

+ CacheWritePrice sql.NullInt64

+ CreatedAt time.Time

+ InputPrice sql.NullInt64

+ Model string

+ OutputPrice sql.NullInt64

+ Provider string

+ UpdatedAt time.Time

+ type AuditableGroupAiBudget struct

+ GroupName string

+ SpendLimit string

type AutoArchiveInactiveChatsRow

+ GroupACL json.RawMessage

+ LastTurnSummary sql.NullString

+ UserACL json.RawMessage

+ type BoundaryLog struct

+ CapturedAt time.Time

+ CreatedAt time.Time

+ Detail string

+ ID uuid.UUID

+ MatchedRule sql.NullString

+ Method string

+ Proto string

+ SequenceNumber int32

+ SessionID uuid.UUID

+ type BoundarySession struct

+ ConfinedProcessName string

+ ID uuid.UUID

+ StartedAt time.Time

+ UpdatedAt time.Time

+ WorkspaceAgentID uuid.UUID

type Chat

+ GroupACL ChatACL

+ LastTurnSummary sql.NullString

+ OwnerName string

+ OwnerUsername string

+ UserACL ChatACL

+ func (c Chat) IsSubChat() bool

+ type ChatACL map[string]ChatACLEntry

+ func (c *ChatACL) Scan(src interface{}) error

+ func (c ChatACL) RBACACL() map[string][]policy.Action

+ func (c ChatACL) Value() (driver.Value, error)

+ type ChatACLEntry struct

+ Permissions []policy.Action

type ChatMessage

+ APIKeyID sql.NullString

type ChatModelConfig

+ AIProviderID uuid.NullUUID

type ChatQueuedMessage

+ APIKeyID sql.NullString

+ type ChatTable struct

+ AgentID uuid.NullUUID

+ Archived bool

+ BuildID uuid.NullUUID

+ ClientType ChatClientType

+ CreatedAt time.Time

+ DynamicTools pqtype.NullRawMessage

+ GroupACL ChatACL

+ HeartbeatAt sql.NullTime

+ ID uuid.UUID

+ Labels StringMap

+ LastError pqtype.NullRawMessage

+ LastInjectedContext pqtype.NullRawMessage

+ LastModelConfigID uuid.UUID

+ LastReadMessageID sql.NullInt64

+ LastTurnSummary sql.NullString

+ MCPServerIDs []uuid.UUID

+ Mode NullChatMode

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ ParentChatID uuid.NullUUID

+ PinOrder int32

+ PlanMode NullChatPlanMode

+ RootChatID uuid.NullUUID

+ StartedAt sql.NullTime

+ Status ChatStatus

+ Title string

+ UpdatedAt time.Time

+ UserACL ChatACL

+ WorkerID uuid.NullUUID

+ WorkspaceID uuid.NullUUID

type CheckConstraint

+ const CheckAiModelPricesCacheReadPriceCheck

+ const CheckAiModelPricesCacheWritePriceCheck

+ const CheckAiModelPricesInputPriceCheck

+ const CheckAiModelPricesOutputPriceCheck

+ const CheckAiProvidersNameCheck

+ const CheckBoundaryLogsSequenceNumberCheck

+ const CheckChatAclOnlyOnRootChats

+ const CheckChatGroupAclNotNullJsonb

+ const CheckChatModelConfigsAiProviderRequiredWhenActive

+ const CheckChatUserAclNotNullJsonb

+ const CheckGroupAiBudgetsSpendLimitMicrosCheck

+ const CheckUserAiProviderKeysAPIKeyCheck

+ const CheckUserSkillsContentSize

+ const CheckUserSkillsDescriptionSize

+ const CheckUserSkillsNameFormat

+ const CheckUserSkillsNameSize

type CountAIBridgeInterceptionsParams

+ ProviderName string

type CountAIBridgeSessionsParams

+ ProviderName string

+ type DeleteOldBoundaryLogsParams struct

+ BeforeTime time.Time

+ LimitCount int32

+ type DeleteOldChatDebugRunsParams struct

+ BeforeTime time.Time

+ LimitCount int32

+ type DeleteUserAIProviderKeyParams struct

+ AIProviderID uuid.UUID

+ UserID uuid.UUID

+ type DeleteUserSkillByUserIDAndNameParams struct

+ Name string

+ UserID uuid.UUID

type ForeignKeyConstraint

+ const ForeignKeyAiProviderKeysAPIKeyKeyID

+ const ForeignKeyAiProviderKeysProviderID

+ const ForeignKeyAiProvidersSettingsKeyID

+ const ForeignKeyBoundaryLogsSessionID

+ const ForeignKeyBoundarySessionsWorkspaceAgentID

+ const ForeignKeyChatMessagesAPIKeyID

+ const ForeignKeyChatModelConfigsAiProviderID

+ const ForeignKeyChatQueuedMessagesAPIKeyID

+ const ForeignKeyGroupAiBudgetsGroupID

+ const ForeignKeyUserAiProviderKeysAPIKeyKeyID

+ const ForeignKeyUserAiProviderKeysAiProviderID

+ const ForeignKeyUserAiProviderKeysUserID

+ const ForeignKeyUserSkillsUserID

+ type GetAIModelPriceByProviderModelParams struct

+ Model string

+ Provider string

+ type GetAIProvidersParams struct

+ IncludeDeleted bool

+ IncludeDisabled bool

+ type GetChatACLByIDRow struct

+ Groups ChatACL

+ Users ChatACL

+ type GetChatUserPromptsByChatIDParams struct

+ ChatID uuid.UUID

+ LimitVal int32

+ type GetChatUserPromptsByChatIDRow struct

+ ID int64

+ Text string

type GetChatsParams

+ DiffURL sql.NullString

+ HasUnread sql.NullBool

+ OwnedOnly bool

+ PrNumber int32

+ PrTitleQuery string

+ PullRequestStatuses []string

+ RepoQuery string

+ SharedOnly bool

+ TitleQuery string

+ ViewerID uuid.UUID

+ type GetUserAIProviderKeyByProviderIDParams struct

+ AIProviderID uuid.UUID

+ UserID uuid.UUID

+ type GetUserAppearanceSettingsRow struct

+ TerminalFont string

+ ThemeDark string

+ ThemeLight string

+ ThemeMode string

+ ThemePreference string

+ type GetUserChatPersonalModelOverrideParams struct

+ Key string

+ UserID uuid.UUID

+ type GetUserSecretsTelemetrySummaryRow struct

+ Both int64

+ EnvNameOnly int64

+ FilePathOnly int64

+ Neither int64

+ SecretsPerUserMax int64

+ SecretsPerUserP25 int64

+ SecretsPerUserP50 int64

+ SecretsPerUserP75 int64

+ SecretsPerUserP90 int64

+ TotalSecrets int64

+ UsersWithSecrets int64

+ type GetUserSkillByUserIDAndNameParams struct

+ Name string

+ UserID uuid.UUID

+ type GetWorkspaceAgentScriptsByAgentIDsRow struct

+ CreatedAt time.Time

+ Cron string

+ DisplayName string

+ ExitCode sql.NullInt32

+ ID uuid.UUID

+ LogPath string

+ LogSourceID uuid.UUID

+ RunOnStart bool

+ RunOnStop bool

+ Script string

+ StartBlocksLogin bool

+ Status NullWorkspaceAgentScriptTimingStatus

+ TimeoutSeconds int32

+ WorkspaceAgentID uuid.UUID

+ type GetWorkspaceBuildAgentsByInstanceIDRow struct

+ WorkspaceAgent WorkspaceAgent

+ WorkspaceBuildID uuid.UUID

+ WorkspaceTable WorkspaceTable

+ func (r GetWorkspaceBuildAgentsByInstanceIDRow) RBACObject() rbac.Object

+ type GroupAiBudget struct

+ CreatedAt time.Time

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ UpdatedAt time.Time

+ func (b GroupAiBudget) Auditable(groupName string) AuditableGroupAiBudget

+ type InsertAIProviderKeyParams struct

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ CreatedAt time.Time

+ ID uuid.UUID

+ ProviderID uuid.UUID

+ UpdatedAt time.Time

+ type InsertAIProviderParams struct

+ BaseUrl string

+ DisplayName sql.NullString

+ Enabled bool

+ ID uuid.UUID

+ Name string

+ Settings sql.NullString

+ SettingsKeyID sql.NullString

+ Type AIProviderType

+ type InsertBoundaryLogParams struct

+ CapturedAt time.Time

+ CreatedAt time.Time

+ Detail string

+ ID uuid.UUID

+ MatchedRule sql.NullString

+ Method string

+ Proto string

+ SequenceNumber int32

+ SessionID uuid.UUID

+ type InsertBoundarySessionParams struct

+ ConfinedProcessName string

+ ID uuid.UUID

+ StartedAt time.Time

+ UpdatedAt time.Time

+ WorkspaceAgentID uuid.UUID

type InsertChatMessagesParams

+ APIKeyID []string

type InsertChatModelConfigParams

+ AIProviderID uuid.NullUUID

type InsertChatQueuedMessageParams

+ APIKeyID sql.NullString

type InsertMCPServerConfigParams

+ ForwardCoderHeaders bool

+ type InsertUserSkillParams struct

+ Content string

+ Description string

+ ID uuid.UUID

+ Name string

+ UserID uuid.UUID

type ListAIBridgeInterceptionsParams

+ ProviderName string

type ListAIBridgeSessionsParams

+ ProviderName string

+ type ListBoundaryLogsBySessionIDParams struct

+ LimitOpt int32

+ SeqAfter sql.NullInt32

+ SeqBefore sql.NullInt32

+ SessionID uuid.UUID

+ type ListUserChatPersonalModelOverridesRow struct

+ Key string

+ Value string

+ type ListUserSkillMetadataByUserIDRow struct

+ CreatedAt time.Time

+ Description string

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

+ UserID uuid.UUID

type MCPServerConfig

+ ForwardCoderHeaders bool

+ type NullAIProviderType struct

+ AIProviderType AIProviderType

+ Valid bool

+ func (ns *NullAIProviderType) Scan(value interface{}) error

+ func (ns NullAIProviderType) Value() (driver.Value, error)

+ type ReorderChatQueuedMessageToFrontParams struct

+ ChatID uuid.UUID

+ TargetID int64

type ResourceType

+ const ResourceTypeAIProvider

+ const ResourceTypeAIProviderKey

+ const ResourceTypeGroupAiBudget

+ const ResourceTypeUserSkill

+ type SoftDeletePriorWorkspaceAgentsParams struct

+ CurrentBuildID uuid.UUID

+ WorkspaceID uuid.UUID

type UniqueConstraint

+ const UniqueAiModelPricesPkey

+ const UniqueAiProviderKeysPkey

+ const UniqueAiProvidersNameUnique

+ const UniqueAiProvidersPkey

+ const UniqueBoundaryLogsPkey

+ const UniqueBoundarySessionsPkey

+ const UniqueGroupAiBudgetsPkey

+ const UniqueUserAiProviderKeysPkey

+ const UniqueUserAiProviderKeysUserIDAiProviderIDKey

+ const UniqueUserSkillsPkey

+ const UniqueUserSkillsUserIDNameIndex

type UpdateAIBridgeInterceptionEndedParams

+ CredentialHint string

+ type UpdateAIProviderParams struct

+ BaseUrl string

+ DisplayName sql.NullString

+ Enabled bool

+ ID uuid.UUID

+ Settings sql.NullString

+ SettingsKeyID sql.NullString

+ type UpdateChatACLByIDParams struct

+ GroupACL ChatACL

+ ID uuid.UUID

+ UserACL ChatACL

+ type UpdateChatLastTurnSummaryParams struct

+ ExpectedUpdatedAt time.Time

+ ID uuid.UUID

+ LastTurnSummary sql.NullString

type UpdateChatModelConfigParams

+ AIProviderID uuid.NullUUID

+ type UpdateEncryptedAIProviderKeyParams struct

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ ID uuid.UUID

+ type UpdateEncryptedAIProviderSettingsParams struct

+ ID uuid.UUID

+ Settings sql.NullString

+ SettingsKeyID sql.NullString

+ type UpdateEncryptedUserAIProviderKeyParams struct

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ ID uuid.UUID

type UpdateMCPServerConfigParams

+ ForwardCoderHeaders bool

+ type UpdateUserAIProviderKeyParams struct

+ AIProviderID uuid.UUID

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ UserID uuid.UUID

+ type UpdateUserAgentChatSendShortcutParams struct

+ AgentChatSendShortcut string

+ UserID uuid.UUID

+ type UpdateUserCodeDiffDisplayModeParams struct

+ CodeDiffDisplayMode string

+ UserID uuid.UUID

+ type UpdateUserShellToolDisplayModeParams struct

+ ShellToolDisplayMode string

+ UserID uuid.UUID

+ type UpdateUserSkillByUserIDAndNameParams struct

+ Content string

+ Description string

+ Name string

+ UserID uuid.UUID

+ type UpdateUserThemeDarkParams struct

+ ThemeDark string

+ UserID uuid.UUID

+ type UpdateUserThemeLightParams struct

+ ThemeLight string

+ UserID uuid.UUID

+ type UpdateUserThemeModeParams struct

+ ThemeMode string

+ UserID uuid.UUID

+ type UpsertGroupAIBudgetParams struct

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ type UpsertUserAIProviderKeyParams struct

+ AIProviderID uuid.UUID

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ CreatedAt time.Time

+ ID uuid.UUID

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type UpsertUserChatPersonalModelOverrideParams struct

+ Key string

+ UserID uuid.UUID

+ Value string

+ type UserAiProviderKey struct

+ AIProviderID uuid.UUID

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ CreatedAt time.Time

+ ID uuid.UUID

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type UserSkill struct

+ Content string

+ CreatedAt time.Time

+ Description string

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ func (s UserSkill) RBACObject() rbac.Object

Jun 17, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 11, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 8, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 23, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type GetGroupMembersCountByGroupIDsParams struct

+ GroupIds []uuid.UUID

+ IncludeSystem bool

+ type GetGroupMembersCountByGroupIDsRow struct

+ GroupID uuid.UUID

+ MemberCount int64

type GetGroupsParams

+ LimitOpt int32

+ Search string

May 19, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +19 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 7, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 6, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 5, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AIBridgeInterception

+ CredentialHint string

+ CredentialKind CredentialKind

type APIKeyScope

+ const ApiKeyScopeAiSeat

+ const ApiKeyScopeAiSeatCreate

+ const ApiKeyScopeAiSeatRead

+ type AutoArchiveInactiveChatsParams struct

+ ArchiveCutoff time.Time

+ LimitCount int32

+ type AutoArchiveInactiveChatsRow struct

+ AgentID uuid.NullUUID

+ Archived bool

+ BuildID uuid.NullUUID

+ ClientType ChatClientType

+ CreatedAt time.Time

+ DynamicTools pqtype.NullRawMessage

+ HeartbeatAt sql.NullTime

+ ID uuid.UUID

+ Labels json.RawMessage

+ LastActivityAt time.Time

+ LastError sql.NullString

+ LastInjectedContext pqtype.NullRawMessage

+ LastModelConfigID uuid.UUID

+ LastReadMessageID sql.NullInt64

+ MCPServerIDs []uuid.UUID

+ Mode NullChatMode

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ ParentChatID uuid.NullUUID

+ PinOrder int32

+ PlanMode NullChatPlanMode

+ RootChatID uuid.NullUUID

+ StartedAt sql.NullTime

+ Status ChatStatus

+ Title string

+ UpdatedAt time.Time

+ WorkerID uuid.NullUUID

+ WorkspaceID uuid.NullUUID

type Chat

+ ClientType ChatClientType

+ DynamicTools pqtype.NullRawMessage

+ OrganizationID uuid.UUID

+ PlanMode NullChatPlanMode

+ type ChatClientType string

+ const ChatClientTypeApi

+ const ChatClientTypeUi

+ func AllChatClientTypeValues() []ChatClientType

+ func (e *ChatClientType) Scan(src interface{}) error

+ func (e ChatClientType) Valid() bool

+ type ChatDebugRun struct

+ ChatID uuid.UUID

+ FinishedAt sql.NullTime

+ HistoryTipMessageID sql.NullInt64

+ ID uuid.UUID

+ Kind string

+ Model sql.NullString

+ ModelConfigID uuid.NullUUID

+ ParentChatID uuid.NullUUID

+ Provider sql.NullString

+ RootChatID uuid.NullUUID

+ StartedAt time.Time

+ Status string

+ Summary json.RawMessage

+ TriggerMessageID sql.NullInt64

+ UpdatedAt time.Time

+ type ChatDebugStep struct

+ AssistantMessageID sql.NullInt64

+ Attempts json.RawMessage

+ ChatID uuid.UUID

+ Error pqtype.NullRawMessage

+ FinishedAt sql.NullTime

+ HistoryTipMessageID sql.NullInt64

+ ID uuid.UUID

+ Metadata json.RawMessage

+ NormalizedRequest json.RawMessage

+ NormalizedResponse pqtype.NullRawMessage

+ Operation string

+ RunID uuid.UUID

+ StartedAt time.Time

+ Status string

+ StepNumber int32

+ UpdatedAt time.Time

+ Usage pqtype.NullRawMessage

type ChatMode

+ const ChatModeExplore

+ type ChatPlanMode string

+ const ChatPlanModePlan

+ func AllChatPlanModeValues() []ChatPlanMode

+ func (e *ChatPlanMode) Scan(src interface{}) error

+ func (e ChatPlanMode) Valid() bool

type ChatQueuedMessage

+ ModelConfigID uuid.NullUUID

type ChatStatus

+ const ChatStatusRequiresAction

type CheckConstraint

+ const CheckChatsPinOrderArchivedCheck

+ const CheckChatsPinOrderParentCheck

+ type CredentialKind string

+ const CredentialKindByok

+ const CredentialKindCentralized

+ func AllCredentialKindValues() []CredentialKind

+ func (e *CredentialKind) Scan(src interface{}) error

+ func (e CredentialKind) Valid() bool

+ type DeleteAllTailnetTunnelsRow struct

+ DstID uuid.UUID

+ SrcID uuid.UUID

+ type DeleteChatDebugDataAfterMessageIDParams struct

+ ChatID uuid.UUID

+ MessageID int64

+ StartedBefore time.Time

+ type DeleteChatDebugDataByChatIDParams struct

+ ChatID uuid.UUID

+ StartedBefore time.Time

+ type DeleteOldChatFilesParams struct

+ BeforeTime time.Time

+ LimitCount int32

+ type DeleteOldChatsParams struct

+ BeforeTime time.Time

+ LimitCount int32

+ type FinalizeStaleChatDebugRowsParams struct

+ Now time.Time

+ UpdatedBefore time.Time

+ type FinalizeStaleChatDebugRowsRow struct

+ RunsFinalized int64

+ StepsFinalized int64

type ForeignKeyConstraint

+ const ForeignKeyChatDebugRunsChatID

+ const ForeignKeyChatDebugStepsChatID

+ const ForeignKeyChatsOrganizationID

+ const ForeignKeyFkChatDebugStepsRunChat

+ type GetChatDebugRunsByChatIDParams struct

+ ChatID uuid.UUID

+ LimitVal int32

+ type GetChatDiffStatusSummaryRow struct

+ Closed int64

+ Merged int64

+ Open int64

+ Total int64

+ type GetChatMessageSummariesPerChatRow struct

+ AssistantMessageCount int64

+ ChatID uuid.UUID

+ CompressedMessageCount int64

+ DistinctModelCount int64

+ MessageCount int64

+ SystemMessageCount int64

+ ToolMessageCount int64

+ TotalCacheCreationTokens int64

+ TotalCacheReadTokens int64

+ TotalCostMicros int64

+ TotalInputTokens int64

+ TotalOutputTokens int64

+ TotalReasoningTokens int64

+ TotalRuntimeMs int64

+ UserMessageCount int64

type GetChatMessagesByChatIDDescPaginatedParams

+ AfterID int64

+ type GetChatModelConfigsForTelemetryRow struct

+ ContextLimit int64

+ Enabled bool

+ ID uuid.UUID

+ IsDefault bool

+ Model string

+ Provider string

+ type GetChatsUpdatedAfterRow struct

+ Archived bool

+ ClientType ChatClientType

+ CreatedAt time.Time

+ HasParent bool

+ ID uuid.UUID

+ LastModelConfigID uuid.UUID

+ Mode NullChatMode

+ OwnerID uuid.UUID

+ PullRequestState sql.NullString

+ RootChatID uuid.NullUUID

+ Status ChatStatus

+ UpdatedAt time.Time

+ WorkspaceID uuid.NullUUID

+ type GetChildChatsByParentIDsParams struct

+ Archived sql.NullBool

+ ParentIds []uuid.UUID

+ type GetChildChatsByParentIDsRow struct

+ Chat Chat

+ HasUnread bool

+ func (r GetChildChatsByParentIDsRow) RBACObject() rbac.Object

+ type GetLatestWorkspaceBuildWithStatusByWorkspaceIDRow struct

+ BuildNumber int32

+ JobStatus ProvisionerJobStatus

+ Transition WorkspaceTransition

+ WorkspaceTable WorkspaceTable

+ func (r GetLatestWorkspaceBuildWithStatusByWorkspaceIDRow) RBACObject() rbac.Object

+ type GetPRInsightsPullRequestsParams struct

+ EndDate time.Time

+ OwnerID uuid.NullUUID

+ StartDate time.Time

+ type GetPRInsightsPullRequestsRow struct

+ Additions int32

+ Approved sql.NullBool

+ AuthorAvatarUrl sql.NullString

+ AuthorLogin sql.NullString

+ BaseBranch string

+ ChangedFiles int32

+ ChangesRequested bool

+ ChatID uuid.UUID

+ Commits sql.NullInt32

+ CostMicros int64

+ CreatedAt time.Time

+ Deletions int32

+ Draft bool

+ ModelDisplayName string

+ PrNumber sql.NullInt32

+ PrTitle string

+ PrUrl sql.NullString

+ ReviewerCount sql.NullInt32

+ State sql.NullString

type GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerRow

+ WorkspaceBuildTransition NullWorkspaceTransition

type GetUserChatSpendInPeriodParams

+ OrganizationID uuid.NullUUID

+ type GetUserGroupSpendLimitParams struct

+ OrganizationID uuid.NullUUID

+ UserID uuid.UUID

type InsertAIBridgeInterceptionParams

+ CredentialHint string

+ CredentialKind CredentialKind

+ type InsertChatDebugRunParams struct

+ ChatID uuid.UUID

+ FinishedAt sql.NullTime

+ HistoryTipMessageID sql.NullInt64

+ Kind string

+ Model sql.NullString

+ ModelConfigID uuid.NullUUID

+ ParentChatID uuid.NullUUID

+ Provider sql.NullString

+ RootChatID uuid.NullUUID

+ StartedAt sql.NullTime

+ Status string

+ Summary pqtype.NullRawMessage

+ TriggerMessageID sql.NullInt64

+ UpdatedAt sql.NullTime

+ type InsertChatDebugStepParams struct

+ AssistantMessageID sql.NullInt64

+ Attempts pqtype.NullRawMessage

+ ChatID uuid.UUID

+ Error pqtype.NullRawMessage

+ FinishedAt sql.NullTime

+ HistoryTipMessageID sql.NullInt64

+ Metadata pqtype.NullRawMessage

+ NormalizedRequest pqtype.NullRawMessage

+ NormalizedResponse pqtype.NullRawMessage

+ Operation string

+ RunID uuid.UUID

+ StartedAt sql.NullTime

+ Status string

+ StepNumber int32

+ UpdatedAt sql.NullTime

+ Usage pqtype.NullRawMessage

type InsertChatParams

+ ClientType ChatClientType

+ DynamicTools pqtype.NullRawMessage

+ OrganizationID uuid.UUID

+ PlanMode NullChatPlanMode

type InsertChatQueuedMessageParams

+ ModelConfigID uuid.NullUUID

type InsertMCPServerConfigParams

+ AllowInPlanMode bool

type ListAIBridgeSessionsRow

+ LastActiveAt time.Time

type MCPServerConfig

+ AllowInPlanMode bool

+ type NullChatClientType struct

+ ChatClientType ChatClientType

+ Valid bool

+ func (ns *NullChatClientType) Scan(value interface{}) error

+ func (ns NullChatClientType) Value() (driver.Value, error)

+ type NullChatPlanMode struct

+ ChatPlanMode ChatPlanMode

+ Valid bool

+ func (ns *NullChatPlanMode) Scan(value interface{}) error

+ func (ns NullChatPlanMode) Value() (driver.Value, error)

+ type NullCredentialKind struct

+ CredentialKind CredentialKind

+ Valid bool

+ func (ns *NullCredentialKind) Scan(value interface{}) error

+ func (ns NullCredentialKind) Value() (driver.Value, error)

+ type ResolveUserChatSpendLimitParams struct

+ OrganizationID uuid.NullUUID

+ UserID uuid.UUID

+ type ResolveUserChatSpendLimitRow struct

+ EffectiveLimitMicros int64

+ LimitSource string

type ResourceType

+ const ResourceTypeChat

+ const ResourceTypeUserSecret

+ type TouchChatDebugRunUpdatedAtParams struct

+ ChatID uuid.UUID

+ ID uuid.UUID

+ Now time.Time

+ type TouchChatDebugStepAndRunParams struct

+ ChatID uuid.UUID

+ Now time.Time

+ RunID uuid.UUID

+ StepID uuid.UUID

type UniqueConstraint

+ const UniqueChatDebugRunsPkey

+ const UniqueChatDebugStepsPkey

+ const UniqueIndexChatDebugRunsIDChat

+ const UniqueIndexChatDebugStepsRunStep

+ const UniqueWebpushSubscriptionsUserIDEndpointIndex

+ type UpdateChatDebugRunParams struct

+ ChatID uuid.UUID

+ FinishedAt sql.NullTime

+ HistoryTipMessageID sql.NullInt64

+ ID uuid.UUID

+ Model sql.NullString

+ ModelConfigID uuid.NullUUID

+ Now time.Time

+ ParentChatID uuid.NullUUID

+ Provider sql.NullString

+ RootChatID uuid.NullUUID

+ Status sql.NullString

+ Summary pqtype.NullRawMessage

+ TriggerMessageID sql.NullInt64

+ type UpdateChatDebugStepParams struct

+ AssistantMessageID sql.NullInt64

+ Attempts pqtype.NullRawMessage

+ ChatID uuid.UUID

+ Error pqtype.NullRawMessage

+ FinishedAt sql.NullTime

+ HistoryTipMessageID sql.NullInt64

+ ID uuid.UUID

+ Metadata pqtype.NullRawMessage

+ NormalizedRequest pqtype.NullRawMessage

+ NormalizedResponse pqtype.NullRawMessage

+ Now time.Time

+ Status sql.NullString

+ Usage pqtype.NullRawMessage

+ type UpdateChatPlanModeByIDParams struct

+ ID uuid.UUID

+ PlanMode NullChatPlanMode

+ type UpdateChatTitleByIDParams struct

+ ID uuid.UUID

+ Title string

type UpdateMCPServerConfigParams

+ AllowInPlanMode bool

+ type UpdateUserThinkingDisplayModeParams struct

+ ThinkingDisplayMode string

+ UserID uuid.UUID

+ type UpsertUserChatDebugLoggingEnabledParams struct

+ DebugLoggingEnabled bool

+ UserID uuid.UUID

Apr 22, 2026 GO-2026-5169 +1 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

Apr 15, 2026 GO-2026-5169 +1 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

Apr 8, 2026 GO-2026-5169 +1 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

Apr 1, 2026 GO-2026-5169 +1 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

Jun 17, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 11, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Jun 8, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 30, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 19, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 28, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 14, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AIBridgeInterception

+ ClientSessionID sql.NullString

+ ProviderName string

+ SessionID string

+ ThreadParentID uuid.NullUUID

+ ThreadRootID uuid.NullUUID

+ type AIBridgeModelThought struct

+ Content string

+ CreatedAt time.Time

+ InterceptionID uuid.UUID

+ Metadata pqtype.NullRawMessage

type AIBridgeTokenUsage

+ CacheReadInputTokens int64

+ CacheWriteInputTokens int64

type AIBridgeToolUsage

+ ProviderToolCallID sql.NullString

type APIKeyScope

+ const ApiKeyScopeChat

+ const ApiKeyScopeChatCreate

+ const ApiKeyScopeChatDelete

+ const ApiKeyScopeChatRead

+ const ApiKeyScopeChatUpdate

+ type AcquireChatsParams struct

+ NumChats int32

+ StartedAt time.Time

+ WorkerID uuid.UUID

+ type AcquireStaleChatDiffStatusesRow struct

+ Additions int32

+ Approved sql.NullBool

+ AuthorAvatarUrl sql.NullString

+ AuthorLogin sql.NullString

+ BaseBranch sql.NullString

+ ChangedFiles int32

+ ChangesRequested bool

+ ChatID uuid.UUID

+ Commits sql.NullInt32

+ CreatedAt time.Time

+ Deletions int32

+ GitBranch string

+ GitRemoteOrigin string

+ HeadBranch sql.NullString

+ OwnerID uuid.UUID

+ PrNumber sql.NullInt32

+ PullRequestDraft bool

+ PullRequestState sql.NullString

+ PullRequestTitle string

+ RefreshedAt sql.NullTime

+ ReviewerCount sql.NullInt32

+ StaleAt time.Time

+ UpdatedAt time.Time

+ Url sql.NullString

+ type AiSeatState struct

+ FirstUsedAt time.Time

+ LastEventDescription string

+ LastEventType AiSeatUsageReason

+ LastUsedAt time.Time

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type AiSeatUsageReason string

+ const AiSeatUsageReasonAibridge

+ const AiSeatUsageReasonTask

+ func AllAiSeatUsageReasonValues() []AiSeatUsageReason

+ func (e *AiSeatUsageReason) Scan(src interface{}) error

+ func (e AiSeatUsageReason) Valid() bool

+ type BackoffChatDiffStatusParams struct

+ ChatID uuid.UUID

+ StaleAt time.Time

+ type BatchUpsertConnectionLogsParams struct

+ AgentName []string

+ Code []int32

+ CodeValid []bool

+ ConnectTime []time.Time

+ ConnectionID []uuid.UUID

+ DisconnectReason []string

+ DisconnectTime []time.Time

+ ID []uuid.UUID

+ Ip []pqtype.Inet

+ OrganizationID []uuid.UUID

+ SlugOrPort []string

+ Type []ConnectionType

+ UserAgent []string

+ UserID []uuid.UUID

+ WorkspaceID []uuid.UUID

+ WorkspaceName []string

+ WorkspaceOwnerID []uuid.UUID

type Chat

+ AgentID uuid.NullUUID

+ Archived bool

+ BuildID uuid.NullUUID

+ HeartbeatAt sql.NullTime

+ Labels StringMap

+ LastError sql.NullString

+ LastInjectedContext pqtype.NullRawMessage

+ LastModelConfigID uuid.UUID

+ LastReadMessageID sql.NullInt64

+ MCPServerIDs []uuid.UUID

+ Mode NullChatMode

+ ParentChatID uuid.NullUUID

+ PinOrder int32

+ RootChatID uuid.NullUUID

+ StartedAt sql.NullTime

+ Status ChatStatus

+ WorkerID uuid.NullUUID

+ WorkspaceID uuid.NullUUID

+ type ChatDiffStatus struct

+ Additions int32

+ Approved sql.NullBool

+ AuthorAvatarUrl sql.NullString

+ AuthorLogin sql.NullString

+ BaseBranch sql.NullString

+ ChangedFiles int32

+ ChangesRequested bool

+ ChatID uuid.UUID

+ Commits sql.NullInt32

+ CreatedAt time.Time

+ Deletions int32

+ GitBranch string

+ GitRemoteOrigin string

+ HeadBranch sql.NullString

+ PrNumber sql.NullInt32

+ PullRequestDraft bool

+ PullRequestState sql.NullString

+ PullRequestTitle string

+ RefreshedAt sql.NullTime

+ ReviewerCount sql.NullInt32

+ StaleAt time.Time

+ UpdatedAt time.Time

+ Url sql.NullString

+ type ChatFile struct

+ CreatedAt time.Time

+ Data []byte

+ ID uuid.UUID

+ Mimetype string

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ func (c ChatFile) RBACObject() rbac.Object

+ type ChatFileLink struct

+ ChatID uuid.UUID

+ FileID uuid.UUID

type ChatMessage

+ CacheCreationTokens sql.NullInt64

+ CacheReadTokens sql.NullInt64

+ Compressed bool

+ ContentVersion int16

+ ContextLimit sql.NullInt64

+ CreatedBy uuid.NullUUID

+ Deleted bool

+ InputTokens sql.NullInt64

+ ModelConfigID uuid.NullUUID

+ OutputTokens sql.NullInt64

+ ProviderResponseID sql.NullString

+ ReasoningTokens sql.NullInt64

+ Role ChatMessageRole

+ RuntimeMs sql.NullInt64

+ TotalCostMicros sql.NullInt64

+ TotalTokens sql.NullInt64

+ Visibility ChatMessageVisibility

+ type ChatMessageRole string

+ const ChatMessageRoleAssistant

+ const ChatMessageRoleSystem

+ const ChatMessageRoleTool

+ const ChatMessageRoleUser

+ func AllChatMessageRoleValues() []ChatMessageRole

+ func (e *ChatMessageRole) Scan(src interface{}) error

+ func (e ChatMessageRole) Valid() bool

+ type ChatMessageVisibility string

+ const ChatMessageVisibilityBoth

+ const ChatMessageVisibilityModel

+ const ChatMessageVisibilityUser

+ func AllChatMessageVisibilityValues() []ChatMessageVisibility

+ func (e *ChatMessageVisibility) Scan(src interface{}) error

+ func (e ChatMessageVisibility) Valid() bool

+ type ChatMode string

+ const ChatModeComputerUse

+ func AllChatModeValues() []ChatMode

+ func (e *ChatMode) Scan(src interface{}) error

+ func (e ChatMode) Valid() bool

+ type ChatModelConfig struct

+ CompressionThreshold int32

+ ContextLimit int64

+ CreatedAt time.Time

+ CreatedBy uuid.NullUUID

+ Deleted bool

+ DeletedAt sql.NullTime

+ DisplayName string

+ Enabled bool

+ ID uuid.UUID

+ IsDefault bool

+ Model string

+ Options json.RawMessage

+ Provider string

+ UpdatedAt time.Time

+ UpdatedBy uuid.NullUUID

+ type ChatProvider struct

+ APIKey string

+ AllowCentralApiKeyFallback bool

+ AllowUserApiKey bool

+ ApiKeyKeyID sql.NullString

+ BaseUrl string

+ CentralApiKeyEnabled bool

+ CreatedAt time.Time

+ CreatedBy uuid.NullUUID

+ DisplayName string

+ Enabled bool

+ ID uuid.UUID

+ Provider string

+ UpdatedAt time.Time

+ type ChatQueuedMessage struct

+ ChatID uuid.UUID

+ Content json.RawMessage

+ CreatedAt time.Time

+ ID int64

+ type ChatStatus string

+ const ChatStatusCompleted

+ const ChatStatusError

+ const ChatStatusPaused

+ const ChatStatusPending

+ const ChatStatusRunning

+ const ChatStatusWaiting

+ func AllChatStatusValues() []ChatStatus

+ func (e *ChatStatus) Scan(src interface{}) error

+ func (e ChatStatus) Valid() bool

+ type ChatUsageLimitConfig struct

+ CreatedAt time.Time

+ DefaultLimitMicros int64

+ Enabled bool

+ ID int64

+ Period string

+ Singleton bool

+ UpdatedAt time.Time

type CheckConstraint

+ const CheckChatModelConfigsCompressionThresholdCheck

+ const CheckChatModelConfigsContextLimitCheck

+ const CheckChatProvidersProviderCheck

+ const CheckChatUsageLimitConfigDefaultLimitMicrosCheck

+ const CheckChatUsageLimitConfigPeriodCheck

+ const CheckChatUsageLimitConfigSingletonCheck

+ const CheckGroupsChatSpendLimitMicrosCheck

+ const CheckMcpServerConfigsAuthTypeCheck

+ const CheckMcpServerConfigsAvailabilityCheck

+ const CheckMcpServerConfigsTransportCheck

+ const CheckUserChatProviderKeysAPIKeyCheck

+ const CheckUsersChatSpendLimitMicrosCheck

+ const CheckUsersEmailNotEmpty

+ const CheckUsersServiceAccountLoginType

+ const CheckValidCredentialPolicy

+ type CountAIBridgeSessionsParams struct

+ Client string

+ InitiatorID uuid.UUID

+ Model string

+ Provider string

+ SessionID string

+ StartedAfter time.Time

+ StartedBefore time.Time

type CreateUserSecretParams

+ ValueKeyID sql.NullString

+ type DeleteChatQueuedMessageParams struct

+ ChatID uuid.UUID

+ ID int64

+ type DeleteMCPServerUserTokenParams struct

+ MCPServerConfigID uuid.UUID

+ UserID uuid.UUID

+ type DeleteUserChatCompactionThresholdParams struct

+ Key string

+ UserID uuid.UUID

+ type DeleteUserChatProviderKeyParams struct

+ ChatProviderID uuid.UUID

+ UserID uuid.UUID

+ type DeleteUserSecretByUserIDAndNameParams struct

+ Name string

+ UserID uuid.UUID

+ type DeleteWorkspaceACLsByOrganizationParams struct

+ ExcludeServiceAccounts bool

+ OrganizationID uuid.UUID

type ForeignKeyConstraint

+ const ForeignKeyAiSeatStateUserID

+ const ForeignKeyChatDiffStatusesChatID

+ const ForeignKeyChatFileLinksChatID

+ const ForeignKeyChatFileLinksFileID

+ const ForeignKeyChatFilesOrganizationID

+ const ForeignKeyChatFilesOwnerID

+ const ForeignKeyChatMessagesModelConfigID

+ const ForeignKeyChatModelConfigsCreatedBy

+ const ForeignKeyChatModelConfigsProvider

+ const ForeignKeyChatModelConfigsUpdatedBy

+ const ForeignKeyChatProvidersAPIKeyKeyID

+ const ForeignKeyChatProvidersCreatedBy

+ const ForeignKeyChatQueuedMessagesChatID

+ const ForeignKeyChatsAgentID

+ const ForeignKeyChatsBuildID

+ const ForeignKeyChatsLastModelConfigID

+ const ForeignKeyChatsParentChatID

+ const ForeignKeyChatsRootChatID

+ const ForeignKeyChatsWorkspaceID

+ const ForeignKeyMcpServerConfigsAPIKeyValueKeyID

+ const ForeignKeyMcpServerConfigsCreatedBy

+ const ForeignKeyMcpServerConfigsCustomHeadersKeyID

+ const ForeignKeyMcpServerConfigsOauth2ClientSecretKeyID

+ const ForeignKeyMcpServerConfigsUpdatedBy

+ const ForeignKeyMcpServerUserTokensAccessTokenKeyID

+ const ForeignKeyMcpServerUserTokensMcpServerConfigID

+ const ForeignKeyMcpServerUserTokensRefreshTokenKeyID

+ const ForeignKeyMcpServerUserTokensUserID

+ const ForeignKeyUserChatProviderKeysAPIKeyKeyID

+ const ForeignKeyUserChatProviderKeysChatProviderID

+ const ForeignKeyUserChatProviderKeysUserID

+ const ForeignKeyUserSecretsValueKeyID

+ type GetAIBridgeInterceptionLineageByToolCallIDRow struct

+ ThreadParentID uuid.UUID

+ ThreadRootID uuid.UUID

+ type GetChatCostPerChatParams struct

+ EndDate time.Time

+ OwnerID uuid.UUID

+ StartDate time.Time

+ type GetChatCostPerChatRow struct

+ ChatTitle string

+ MessageCount int64

+ RootChatID uuid.UUID

+ TotalCacheCreationTokens int64

+ TotalCacheReadTokens int64

+ TotalCostMicros int64

+ TotalInputTokens int64

+ TotalOutputTokens int64

+ TotalRuntimeMs int64

+ type GetChatCostPerModelParams struct

+ EndDate time.Time

+ OwnerID uuid.UUID

+ StartDate time.Time

+ type GetChatCostPerModelRow struct

+ DisplayName string

+ MessageCount int64

+ Model string

+ ModelConfigID uuid.UUID

+ Provider string

+ TotalCacheCreationTokens int64

+ TotalCacheReadTokens int64

+ TotalCostMicros int64

+ TotalInputTokens int64

+ TotalOutputTokens int64

+ TotalRuntimeMs int64

+ type GetChatCostPerUserParams struct

+ EndDate time.Time

+ PageLimit int32

+ PageOffset int32

+ StartDate time.Time

+ Username string

+ type GetChatCostPerUserRow struct

+ AvatarURL string

+ ChatCount int64

+ MessageCount int64

+ Name string

+ TotalCacheCreationTokens int64

+ TotalCacheReadTokens int64

+ TotalCostMicros int64

+ TotalCount int64

+ TotalInputTokens int64

+ TotalOutputTokens int64

+ TotalRuntimeMs int64

+ UserID uuid.UUID

+ Username string

+ type GetChatCostSummaryParams struct

+ EndDate time.Time

+ OwnerID uuid.UUID

+ StartDate time.Time

+ type GetChatCostSummaryRow struct

+ PricedMessageCount int64

+ TotalCacheCreationTokens int64

+ TotalCacheReadTokens int64

+ TotalCostMicros int64

+ TotalInputTokens int64

+ TotalOutputTokens int64

+ TotalRuntimeMs int64

+ UnpricedMessageCount int64

+ type GetChatFileMetadataByChatIDRow struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Mimetype string

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ func (c GetChatFileMetadataByChatIDRow) RBACObject() rbac.Object

+ type GetChatMessagesByChatIDAscPaginatedParams struct

+ AfterID int64

+ ChatID uuid.UUID

+ LimitVal int32

+ type GetChatMessagesByChatIDDescPaginatedParams struct

+ BeforeID int64

+ ChatID uuid.UUID

+ LimitVal int32

+ type GetChatMessagesByChatIDParams struct

+ AfterID int64

+ ChatID uuid.UUID

+ type GetChatSystemPromptConfigRow struct

+ ChatSystemPrompt string

+ IncludeDefaultSystemPrompt bool

+ type GetChatUsageLimitGroupOverrideRow struct

+ GroupID uuid.UUID

+ SpendLimitMicros sql.NullInt64

+ type GetChatUsageLimitUserOverrideRow struct

+ SpendLimitMicros sql.NullInt64

+ UserID uuid.UUID

+ type GetChatsParams struct

+ AfterID uuid.UUID

+ Archived sql.NullBool

+ LabelFilter pqtype.NullRawMessage

+ LimitOpt int32

+ OffsetOpt int32

+ OwnerID uuid.UUID

+ type GetChatsRow struct

+ Chat Chat

+ HasUnread bool

+ func (r GetChatsRow) RBACObject() rbac.Object

type GetDefaultProxyConfigRow

+ IconURL string

+ type GetGroupMembersByGroupIDPaginatedParams struct

+ AfterID uuid.UUID

+ CreatedAfter time.Time

+ CreatedBefore time.Time

+ GithubComUserID int64

+ GroupID uuid.UUID

+ IncludeSystem bool

+ IsServiceAccount sql.NullBool

+ LastSeenAfter time.Time

+ LastSeenBefore time.Time

+ LimitOpt int32

+ LoginType []LoginType

+ Name string

+ OffsetOpt int32

+ RbacRole []string

+ Search string

+ Status []UserStatus

+ type GetGroupMembersByGroupIDPaginatedRow struct

+ Count int64

+ GroupID uuid.UUID

+ GroupName string

+ OrganizationID uuid.UUID

+ UserAvatarUrl string

+ UserCreatedAt time.Time

+ UserDeleted bool

+ UserEmail string

+ UserGithubComUserID sql.NullInt64

+ UserHashedPassword []byte

+ UserID uuid.UUID

+ UserIsServiceAccount bool

+ UserIsSystem bool

+ UserLastSeenAt time.Time

+ UserLoginType LoginType

+ UserName string

+ UserQuietHoursSchedule string

+ UserRbacRoles []string

+ UserStatus UserStatus

+ UserUpdatedAt time.Time

+ UserUsername string

+ func (gm GetGroupMembersByGroupIDPaginatedRow) RBACObject() rbac.Object

+ type GetLastChatMessageByRoleParams struct

+ ChatID uuid.UUID

+ Role ChatMessageRole

+ type GetMCPServerUserTokenParams struct

+ MCPServerConfigID uuid.UUID

+ UserID uuid.UUID

+ type GetPRInsightsPerModelParams struct

+ EndDate time.Time

+ OwnerID uuid.NullUUID

+ StartDate time.Time

+ type GetPRInsightsPerModelRow struct

+ DisplayName string

+ MergedCostMicros int64

+ MergedPrs int64

+ ModelConfigID uuid.NullUUID

+ Provider string

+ TotalAdditions int64

+ TotalCostMicros int64

+ TotalDeletions int64

+ TotalPrs int64

+ type GetPRInsightsRecentPRsParams struct

+ EndDate time.Time

+ LimitVal int32

+ OwnerID uuid.NullUUID

+ StartDate time.Time

+ type GetPRInsightsRecentPRsRow struct

+ Additions int32

+ Approved sql.NullBool

+ AuthorAvatarUrl sql.NullString

+ AuthorLogin sql.NullString

+ BaseBranch string

+ ChangedFiles int32

+ ChangesRequested bool

+ ChatID uuid.UUID

+ Commits sql.NullInt32

+ CostMicros int64

+ CreatedAt time.Time

+ Deletions int32

+ Draft bool

+ ModelDisplayName string

+ PrNumber sql.NullInt32

+ PrTitle string

+ PrUrl sql.NullString

+ ReviewerCount sql.NullInt32

+ State sql.NullString

+ type GetPRInsightsSummaryParams struct

+ EndDate time.Time

+ OwnerID uuid.NullUUID

+ StartDate time.Time

+ type GetPRInsightsSummaryRow struct

+ MergedCostMicros int64

+ TotalAdditions int64

+ TotalCostMicros int64

+ TotalDeletions int64

+ TotalPrsClosed int64

+ TotalPrsCreated int64

+ TotalPrsMerged int64

+ type GetPRInsightsTimeSeriesParams struct

+ EndDate time.Time

+ OwnerID uuid.NullUUID

+ StartDate time.Time

+ type GetPRInsightsTimeSeriesRow struct

+ Date time.Time

+ PrsClosed int64

+ PrsCreated int64

+ PrsMerged int64

+ type GetTailnetTunnelPeerBindingsBatchRow struct

+ CoordinatorID uuid.UUID

+ LookupID uuid.UUID

+ Node []byte

+ PeerID uuid.UUID

+ Status TailnetStatus

+ UpdatedAt time.Time

+ type GetTailnetTunnelPeerIDsBatchRow struct

+ CoordinatorID uuid.UUID

+ LookupID uuid.UUID

+ PeerID uuid.UUID

+ UpdatedAt time.Time

+ type GetUserChatCompactionThresholdParams struct

+ Key string

+ UserID uuid.UUID

+ type GetUserChatSpendInPeriodParams struct

+ EndTime time.Time

+ StartTime time.Time

+ UserID uuid.UUID

type GetUserStatusCountsParams

+ Tz string

type GetUsersParams

+ IsServiceAccount sql.NullBool

type GetUsersRow

+ ChatSpendLimitMicros sql.NullInt64

+ IsServiceAccount bool

type Group

+ ChatSpendLimitMicros sql.NullInt64

type GroupMember

+ UserIsServiceAccount bool

type InsertAIBridgeInterceptionParams

+ ClientSessionID sql.NullString

+ ProviderName string

+ ThreadParentInterceptionID uuid.NullUUID

+ ThreadRootInterceptionID uuid.NullUUID

+ type InsertAIBridgeModelThoughtParams struct

+ Content string

+ CreatedAt time.Time

+ InterceptionID uuid.UUID

+ Metadata json.RawMessage

type InsertAIBridgeTokenUsageParams

+ CacheReadInputTokens int64

+ CacheWriteInputTokens int64

type InsertAIBridgeToolUsageParams

+ ProviderToolCallID sql.NullString

+ type InsertChatFileParams struct

+ Data []byte

+ Mimetype string

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ type InsertChatFileRow struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Mimetype string

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

type InsertChatMessagesParams

+ CacheCreationTokens []int64

+ CacheReadTokens []int64

+ Compressed []bool

+ ContentVersion []int16

+ ContextLimit []int64

+ CreatedBy []uuid.UUID

+ InputTokens []int64

+ ModelConfigID []uuid.UUID

+ OutputTokens []int64

+ ProviderResponseID []string

+ ReasoningTokens []int64

+ Role []ChatMessageRole

+ RuntimeMs []int64

+ TotalCostMicros []int64

+ TotalTokens []int64

+ Visibility []ChatMessageVisibility

+ type InsertChatModelConfigParams struct

+ CompressionThreshold int32

+ ContextLimit int64

+ CreatedBy uuid.NullUUID

+ DisplayName string

+ Enabled bool

+ IsDefault bool

+ Model string

+ Options json.RawMessage

+ Provider string

+ UpdatedBy uuid.NullUUID

type InsertChatParams

+ AgentID uuid.NullUUID

+ BuildID uuid.NullUUID

+ Labels pqtype.NullRawMessage

+ LastModelConfigID uuid.UUID

+ MCPServerIDs []uuid.UUID

+ Mode NullChatMode

+ ParentChatID uuid.NullUUID

+ RootChatID uuid.NullUUID

+ Status ChatStatus

+ WorkspaceID uuid.NullUUID

+ type InsertChatProviderParams struct

+ APIKey string

+ AllowCentralApiKeyFallback bool

+ AllowUserApiKey bool

+ ApiKeyKeyID sql.NullString

+ BaseUrl string

+ CentralApiKeyEnabled bool

+ CreatedBy uuid.NullUUID

+ DisplayName string

+ Enabled bool

+ Provider string

+ type InsertChatQueuedMessageParams struct

+ ChatID uuid.UUID

+ Content json.RawMessage

+ type InsertMCPServerConfigParams struct

+ APIKeyHeader string

+ APIKeyValue string

+ APIKeyValueKeyID sql.NullString

+ AuthType string

+ Availability string

+ CreatedBy uuid.UUID

+ CustomHeaders string

+ CustomHeadersKeyID sql.NullString

+ Description string

+ DisplayName string

+ Enabled bool

+ IconURL string

+ ModelIntent bool

+ OAuth2AuthURL string

+ OAuth2ClientID string

+ OAuth2ClientSecret string

+ OAuth2ClientSecretKeyID sql.NullString

+ OAuth2Scopes string

+ OAuth2TokenURL string

+ Slug string

+ ToolAllowList []string

+ ToolDenyList []string

+ Transport string

+ UpdatedBy uuid.UUID

+ Url string

type InsertUserParams

+ IsServiceAccount bool

+ type LinkChatFilesParams struct

+ ChatID uuid.UUID

+ FileIds []uuid.UUID

+ MaxFileLinks int32

+ type ListAIBridgeClientsParams struct

+ Client string

+ Limit int32

+ Offset int32

+ type ListAIBridgeModelsParams struct

+ Limit int32

+ Model string

+ Offset int32

+ type ListAIBridgeSessionThreadsParams struct

+ AfterID uuid.UUID

+ BeforeID uuid.UUID

+ Limit int32

+ SessionID string

+ type ListAIBridgeSessionThreadsRow struct

+ AIBridgeInterception AIBridgeInterception

+ ThreadID uuid.UUID

+ type ListAIBridgeSessionsParams struct

+ AfterSessionID string

+ Client string

+ InitiatorID uuid.UUID

+ Limit int32

+ Model string

+ Offset int32

+ Provider string

+ SessionID string

+ StartedAfter time.Time

+ StartedBefore time.Time

+ type ListAIBridgeSessionsRow struct

+ CacheReadInputTokens int64

+ CacheWriteInputTokens int64

+ Client string

+ EndedAt time.Time

+ InputTokens int64

+ LastPrompt string

+ Metadata json.RawMessage

+ Models []string

+ OutputTokens int64

+ Providers []string

+ SessionID string

+ StartedAt time.Time

+ Threads int64

+ UserAvatarUrl string

+ UserID uuid.UUID

+ UserName string

+ UserUsername string

+ type ListChatUsageLimitGroupOverridesRow struct

+ GroupAvatarUrl string

+ GroupDisplayName string

+ GroupID uuid.UUID

+ GroupName string

+ MemberCount int64

+ SpendLimitMicros sql.NullInt64

+ type ListChatUsageLimitOverridesRow struct

+ AvatarURL string

+ Name string

+ SpendLimitMicros sql.NullInt64

+ UserID uuid.UUID

+ Username string

+ type ListUserSecretsRow struct

+ CreatedAt time.Time

+ Description string

+ EnvName string

+ FilePath string

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type MCPServerConfig struct

+ APIKeyHeader string

+ APIKeyValue string

+ APIKeyValueKeyID sql.NullString

+ AuthType string

+ Availability string

+ CreatedAt time.Time

+ CreatedBy uuid.NullUUID

+ CustomHeaders string

+ CustomHeadersKeyID sql.NullString

+ Description string

+ DisplayName string

+ Enabled bool

+ ID uuid.UUID

+ IconURL string

+ ModelIntent bool

+ OAuth2AuthURL string

+ OAuth2ClientID string

+ OAuth2ClientSecret string

+ OAuth2ClientSecretKeyID sql.NullString

+ OAuth2Scopes string

+ OAuth2TokenURL string

+ Slug string

+ ToolAllowList []string

+ ToolDenyList []string

+ Transport string

+ UpdatedAt time.Time

+ UpdatedBy uuid.NullUUID

+ Url string

+ type MCPServerUserToken struct

+ AccessToken string

+ AccessTokenKeyID sql.NullString

+ CreatedAt time.Time

+ Expiry sql.NullTime

+ ID uuid.UUID

+ MCPServerConfigID uuid.UUID

+ RefreshToken string

+ RefreshTokenKeyID sql.NullString

+ TokenType string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type NullAiSeatUsageReason struct

+ AiSeatUsageReason AiSeatUsageReason

+ Valid bool

+ func (ns *NullAiSeatUsageReason) Scan(value interface{}) error

+ func (ns NullAiSeatUsageReason) Value() (driver.Value, error)

+ type NullChatMessageRole struct

+ ChatMessageRole ChatMessageRole

+ Valid bool

+ func (ns *NullChatMessageRole) Scan(value interface{}) error

+ func (ns NullChatMessageRole) Value() (driver.Value, error)

+ type NullChatMessageVisibility struct

+ ChatMessageVisibility ChatMessageVisibility

+ Valid bool

+ func (ns *NullChatMessageVisibility) Scan(value interface{}) error

+ func (ns NullChatMessageVisibility) Value() (driver.Value, error)

+ type NullChatMode struct

+ ChatMode ChatMode

+ Valid bool

+ func (ns *NullChatMode) Scan(value interface{}) error

+ func (ns NullChatMode) Value() (driver.Value, error)

+ type NullChatStatus struct

+ ChatStatus ChatStatus

+ Valid bool

+ func (ns *NullChatStatus) Scan(value interface{}) error

+ func (ns NullChatStatus) Value() (driver.Value, error)

+ type NullShareableWorkspaceOwners struct

+ ShareableWorkspaceOwners ShareableWorkspaceOwners

+ Valid bool

+ func (ns *NullShareableWorkspaceOwners) Scan(value interface{}) error

+ func (ns NullShareableWorkspaceOwners) Value() (driver.Value, error)

type Organization

+ ShareableWorkspaceOwners ShareableWorkspaceOwners

type OrganizationMembersRow

+ IsServiceAccount bool

+ LastSeenAt time.Time

+ LoginType LoginType

+ Status UserStatus

+ UserCreatedAt time.Time

+ UserUpdatedAt time.Time

type PaginatedOrganizationMembersParams

+ AfterID uuid.UUID

+ CreatedAfter time.Time

+ CreatedBefore time.Time

+ GithubComUserID int64

+ IsServiceAccount sql.NullBool

+ LastSeenAfter time.Time

+ LastSeenBefore time.Time

+ LoginType []LoginType

+ Name string

+ RbacRole []string

+ Search string

+ Status []UserStatus

type PaginatedOrganizationMembersRow

+ IsServiceAccount bool

+ LastSeenAt time.Time

+ LoginType LoginType

+ Status UserStatus

+ UserCreatedAt time.Time

+ UserUpdatedAt time.Time

type ResourceType

+ const ResourceTypeAiSeat

+ type ShareableWorkspaceOwners string

+ const ShareableWorkspaceOwnersEveryone

+ const ShareableWorkspaceOwnersNone

+ const ShareableWorkspaceOwnersServiceAccounts

+ func AllShareableWorkspaceOwnersValues() []ShareableWorkspaceOwners

+ func (e *ShareableWorkspaceOwners) Scan(src interface{}) error

+ func (e ShareableWorkspaceOwners) Valid() bool

+ type SoftDeleteChatMessagesAfterIDParams struct

+ AfterID int64

+ ChatID uuid.UUID

type Task

+ WorkspaceGroupACL WorkspaceACL

+ WorkspaceUserACL WorkspaceACL

type UniqueConstraint

+ const UniqueAiSeatStatePkey

+ const UniqueChatDiffStatusesPkey

+ const UniqueChatFileLinksChatIDFileIDKey

+ const UniqueChatFilesPkey

+ const UniqueChatModelConfigsPkey

+ const UniqueChatProvidersPkey

+ const UniqueChatProvidersProviderKey

+ const UniqueChatQueuedMessagesPkey

+ const UniqueChatUsageLimitConfigPkey

+ const UniqueChatUsageLimitConfigSingletonKey

+ const UniqueIndexChatModelConfigsSingleDefault

+ const UniqueMcpServerConfigsPkey

+ const UniqueMcpServerConfigsSlugKey

+ const UniqueMcpServerUserTokensMcpServerConfigIDUserIDKey

+ const UniqueMcpServerUserTokensPkey

+ const UniqueUserChatProviderKeysPkey

+ const UniqueUserChatProviderKeysUserIDChatProviderIDKey

+ type UpdateChatBuildAgentBindingParams struct

+ AgentID uuid.NullUUID

+ BuildID uuid.NullUUID

+ ID uuid.UUID

+ type UpdateChatHeartbeatsParams struct

+ IDs []uuid.UUID

+ Now time.Time

+ WorkerID uuid.UUID

+ type UpdateChatLabelsByIDParams struct

+ ID uuid.UUID

+ Labels json.RawMessage

+ type UpdateChatLastInjectedContextParams struct

+ ID uuid.UUID

+ LastInjectedContext pqtype.NullRawMessage

+ type UpdateChatLastModelConfigByIDParams struct

+ ID uuid.UUID

+ LastModelConfigID uuid.UUID

+ type UpdateChatLastReadMessageIDParams struct

+ ID uuid.UUID

+ LastReadMessageID int64

+ type UpdateChatMCPServerIDsParams struct

+ ID uuid.UUID

+ MCPServerIDs []uuid.UUID

+ type UpdateChatMessageByIDParams struct

+ Content pqtype.NullRawMessage

+ ID int64

+ ModelConfigID uuid.NullUUID

+ type UpdateChatModelConfigParams struct

+ CompressionThreshold int32

+ ContextLimit int64

+ DisplayName string

+ Enabled bool

+ ID uuid.UUID

+ IsDefault bool

+ Model string

+ Options json.RawMessage

+ Provider string

+ UpdatedBy uuid.NullUUID

+ type UpdateChatPinOrderParams struct

+ ID uuid.UUID

+ PinOrder int32

+ type UpdateChatProviderParams struct

+ APIKey string

+ AllowCentralApiKeyFallback bool

+ AllowUserApiKey bool

+ ApiKeyKeyID sql.NullString

+ BaseUrl string

+ CentralApiKeyEnabled bool

+ DisplayName string

+ Enabled bool

+ ID uuid.UUID

+ type UpdateChatStatusParams struct

+ HeartbeatAt sql.NullTime

+ ID uuid.UUID

+ LastError sql.NullString

+ StartedAt sql.NullTime

+ Status ChatStatus

+ WorkerID uuid.NullUUID

+ type UpdateChatStatusPreserveUpdatedAtParams struct

+ HeartbeatAt sql.NullTime

+ ID uuid.UUID

+ LastError sql.NullString

+ StartedAt sql.NullTime

+ Status ChatStatus

+ UpdatedAt time.Time

+ WorkerID uuid.NullUUID

+ type UpdateChatWorkspaceBindingParams struct

+ AgentID uuid.NullUUID

+ BuildID uuid.NullUUID

+ ID uuid.UUID

+ WorkspaceID uuid.NullUUID

+ type UpdateMCPServerConfigParams struct

+ APIKeyHeader string

+ APIKeyValue string

+ APIKeyValueKeyID sql.NullString

+ AuthType string

+ Availability string

+ CustomHeaders string

+ CustomHeadersKeyID sql.NullString

+ Description string

+ DisplayName string

+ Enabled bool

+ ID uuid.UUID

+ IconURL string

+ ModelIntent bool

+ OAuth2AuthURL string

+ OAuth2ClientID string

+ OAuth2ClientSecret string

+ OAuth2ClientSecretKeyID sql.NullString

+ OAuth2Scopes string

+ OAuth2TokenURL string

+ Slug string

+ ToolAllowList []string

+ ToolDenyList []string

+ Transport string

+ UpdatedBy uuid.UUID

+ Url string

type UpdateOrganizationWorkspaceSharingSettingsParams

+ ShareableWorkspaceOwners ShareableWorkspaceOwners

+ type UpdateUserChatCompactionThresholdParams struct

+ Key string

+ ThresholdPercent int32

+ UserID uuid.UUID

+ type UpdateUserChatCustomPromptParams struct

+ ChatCustomPrompt string

+ UserID uuid.UUID

+ type UpdateUserChatProviderKeyParams struct

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ ChatProviderID uuid.UUID

+ UserID uuid.UUID

+ type UpdateUserSecretByUserIDAndNameParams struct

+ Description string

+ EnvName string

+ FilePath string

+ Name string

+ UpdateDescription bool

+ UpdateEnvName bool

+ UpdateFilePath bool

+ UpdateValue bool

+ UserID uuid.UUID

+ Value string

+ ValueKeyID sql.NullString

+ type UpdateWorkspaceAgentDirectoryByIDParams struct

+ Directory string

+ ID uuid.UUID

+ UpdatedAt time.Time

+ type UpsertAISeatStateParams struct

+ FirstUsedAt time.Time

+ LastEventDescription string

+ LastEventType AiSeatUsageReason

+ UserID uuid.UUID

+ type UpsertChatDiffStatusParams struct

+ Additions int32

+ Approved sql.NullBool

+ AuthorAvatarUrl sql.NullString

+ AuthorLogin sql.NullString

+ BaseBranch sql.NullString

+ ChangedFiles int32

+ ChangesRequested bool

+ ChatID uuid.UUID

+ Commits sql.NullInt32

+ Deletions int32

+ HeadBranch sql.NullString

+ PrNumber sql.NullInt32

+ PullRequestDraft bool

+ PullRequestState sql.NullString

+ PullRequestTitle string

+ RefreshedAt time.Time

+ ReviewerCount sql.NullInt32

+ StaleAt time.Time

+ Url sql.NullString

+ type UpsertChatDiffStatusReferenceParams struct

+ ChatID uuid.UUID

+ GitBranch string

+ GitRemoteOrigin string

+ StaleAt time.Time

+ Url sql.NullString

+ type UpsertChatUsageLimitConfigParams struct

+ DefaultLimitMicros int64

+ Enabled bool

+ Period string

+ type UpsertChatUsageLimitGroupOverrideParams struct

+ GroupID uuid.UUID

+ SpendLimitMicros int64

+ type UpsertChatUsageLimitGroupOverrideRow struct

+ AvatarURL string

+ DisplayName string

+ GroupID uuid.UUID

+ Name string

+ SpendLimitMicros sql.NullInt64

+ type UpsertChatUsageLimitUserOverrideParams struct

+ SpendLimitMicros int64

+ UserID uuid.UUID

+ type UpsertChatUsageLimitUserOverrideRow struct

+ AvatarURL string

+ Name string

+ SpendLimitMicros sql.NullInt64

+ UserID uuid.UUID

+ Username string

type UpsertConnectionLogParams

+ IP pqtype.Inet

type UpsertDefaultProxyParams

+ IconURL string

+ type UpsertMCPServerUserTokenParams struct

+ AccessToken string

+ AccessTokenKeyID sql.NullString

+ Expiry sql.NullTime

+ MCPServerConfigID uuid.UUID

+ RefreshToken string

+ RefreshTokenKeyID sql.NullString

+ TokenType string

+ UserID uuid.UUID

+ type UpsertUserChatProviderKeyParams struct

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ ChatProviderID uuid.UUID

+ UserID uuid.UUID

type User

+ ChatSpendLimitMicros sql.NullInt64

+ IsServiceAccount bool

+ type UserChatProviderKey struct

+ APIKey string

+ ApiKeyKeyID sql.NullString

+ ChatProviderID uuid.UUID

+ CreatedAt time.Time

+ ID uuid.UUID

+ UpdatedAt time.Time

+ UserID uuid.UUID

type UserSecret

+ ValueKeyID sql.NullString

Mar 24, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 19, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 1, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 28, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 9, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 9, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 1, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 25, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 13, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 10, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 6, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 4, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 3, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LockIDBoundaryUsageStats

type AIBridgeInterception

+ Client sql.NullString

type APIKeyScope

+ const ApiKeyScopeWorkspaceDormantUpdateAgent

+ const ApiKeyScopeWorkspaceUpdateAgent

type CheckConstraint

+ const CheckGroupAclIsObject

+ const CheckUserAclIsObject

type CountAIBridgeInterceptionsParams

+ Client string

type ForeignKeyConstraint

+ const ForeignKeyWorkspaceAgentDevcontainersSubagentID

+ type GetAPIKeysByLoginTypeParams struct

+ IncludeExpired bool

+ LoginType LoginType

type GetAPIKeysByUserIDParams

+ IncludeExpired bool

+ type GetAndResetBoundaryUsageSummaryRow struct

+ AllowedRequests int64

+ DeniedRequests int64

+ UniqueUsers int64

+ UniqueWorkspaces int64

+ type GetTelemetryTaskEventsParams struct

+ CreatedAfter time.Time

+ Now time.Time

+ type GetTelemetryTaskEventsRow struct

+ ActiveDurationMs int64

+ FirstStatusAfterResumeAt sql.NullTime

+ LastWorkingStatusAt sql.NullTime

+ StartBuildCreatedAt sql.NullTime

+ StartBuildNumber sql.NullInt32

+ StartBuildReason NullBuildReason

+ StopBuildCreatedAt sql.NullTime

+ StopBuildReason NullBuildReason

+ TaskID uuid.UUID

+ WorkspaceAppID uuid.NullUUID

+ WorkspaceID uuid.NullUUID

type GetUsersParams

+ Name string

+ type GetWorkspaceBuildMetricsByResourceIDRow struct

+ AllAgentsReady bool

+ CreatedAt time.Time

+ IsPrebuild bool

+ LastAgentReadyAt time.Time

+ OrganizationName string

+ TemplateName string

+ Transition WorkspaceTransition

+ WorstStatus string

+ type GetWorkspaceBuildProvisionerStateByIDRow struct

+ GroupACL TemplateACL

+ ProvisionerState []byte

+ TemplateID uuid.UUID

+ TemplateOrganizationID uuid.UUID

+ UserACL TemplateACL

+ func (t GetWorkspaceBuildProvisionerStateByIDRow) RBACObject() rbac.Object

type GetWorkspacesParams

+ HasAgentStatuses []string

type InsertAIBridgeInterceptionParams

+ Client sql.NullString

type InsertOAuth2ProviderAppCodeParams

+ RedirectUri sql.NullString

+ StateHash sql.NullString

type InsertWorkspaceAgentDevcontainersParams

+ SubagentID []uuid.UUID

type ListAIBridgeInterceptionsParams

+ Client string

type OAuth2ProviderAppCode

+ RedirectUri sql.NullString

+ StateHash sql.NullString

type Template

+ DisableModuleCache bool

type TemplateTable

+ DisableModuleCache bool

type UpdateTemplateMetaByIDParams

+ DisableModuleCache bool

+ type UpdateWorkspaceAgentDisplayAppsByIDParams struct

+ DisplayApps []DisplayApp

+ ID uuid.UUID

+ UpdatedAt time.Time

type WorkspaceAgentDevcontainer

+ SubagentID uuid.NullUUID

Feb 23, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +18 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 9, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 1, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 25, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 16, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 3, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 23, 2026 GO-2026-5169 +20 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 10, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 3, 2026 GO-2026-5169 +21 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LockIDReconcileSystemRoles

type APIKeyScope

+ const ApiKeyScopeBoundaryUsage

+ const ApiKeyScopeBoundaryUsageDelete

+ const ApiKeyScopeBoundaryUsageRead

+ const ApiKeyScopeBoundaryUsageUpdate

+ type BatchUpdateWorkspaceAgentMetadataParams struct

+ CollectedAt []time.Time

+ Error []string

+ Key []string

+ Value []string

+ WorkspaceAgentID []uuid.UUID

+ type BoundaryUsageStat struct

+ AllowedRequests int64

+ DeniedRequests int64

+ ReplicaID uuid.UUID

+ UniqueUsersCount int64

+ UniqueWorkspacesCount int64

+ UpdatedAt time.Time

+ WindowStart time.Time

type BuildReason

+ const BuildReasonTaskAutoPause

+ const BuildReasonTaskManualPause

+ const BuildReasonTaskResume

type CheckConstraint

+ const CheckOrganizationIDNotZero

type CustomRole

+ IsSystem bool

+ MemberPermissions CustomRolePermissions

type CustomRolesParams

+ IncludeSystemRoles bool

+ type DeleteOldAuditLogsParams struct

+ BeforeTime time.Time

+ LimitCount int32

+ type DeleteOldConnectionLogsParams struct

+ BeforeTime time.Time

+ LimitCount int32

type ForeignKeyConstraint

+ const ForeignKeyTaskSnapshotsTaskID

+ type GetAuthenticatedWorkspaceAgentAndBuildByAuthTokenRow struct

+ TaskID uuid.NullUUID

+ WorkspaceAgent WorkspaceAgent

+ WorkspaceBuild WorkspaceBuild

+ WorkspaceTable WorkspaceTable

+ type GetBoundaryUsageSummaryRow struct

+ AllowedRequests int64

+ DeniedRequests int64

+ UniqueUsers int64

+ UniqueWorkspaces int64

+ type GetWorkspaceAgentAndWorkspaceByIDRow struct

+ OwnerUsername string

+ WorkspaceAgent WorkspaceAgent

+ WorkspaceTable WorkspaceTable

+ func (r GetWorkspaceAgentAndWorkspaceByIDRow) RBACObject() rbac.Object

type GetWorkspacesRow

+ GroupACLDisplayInfo interface{}

+ UserACLDisplayInfo interface{}

type InsertCustomRoleParams

+ IsSystem bool

+ MemberPermissions CustomRolePermissions

type Organization

+ WorkspaceSharingDisabled bool

+ type TaskSnapshot struct

+ LogSnapshot json.RawMessage

+ LogSnapshotCreatedAt time.Time

+ TaskID uuid.UUID

type UniqueConstraint

+ const UniqueBoundaryUsageStatsPkey

+ const UniqueIndexCustomRolesNameLowerOrganizationID

+ const UniqueTaskSnapshotsPkey

type UpdateCustomRoleParams

+ MemberPermissions CustomRolePermissions

+ type UpdateOrganizationWorkspaceSharingSettingsParams struct

+ ID uuid.UUID

+ UpdatedAt time.Time

+ WorkspaceSharingDisabled bool

type UpdateUserStatusParams

+ UserIsSeen bool

+ type UpsertBoundaryUsageStatsParams struct

+ AllowedRequests int64

+ DeniedRequests int64

+ ReplicaID uuid.UUID

+ UniqueUsersCount int64

+ UniqueUsersDelta int64

+ UniqueWorkspacesCount int64

+ UniqueWorkspacesDelta int64

+ type UpsertTaskSnapshotParams struct

+ LogSnapshot json.RawMessage

+ LogSnapshotCreatedAt time.Time

+ TaskID uuid.UUID

type Workspace

+ GroupACLDisplayInfo WorkspaceACLDisplayInfo

+ UserACLDisplayInfo WorkspaceACLDisplayInfo

+ type WorkspaceACLDisplayInfo map[string]struct

+ func (w *WorkspaceACLDisplayInfo) Scan(src interface{}) error

Jun 17, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Changes in this version

+ type CountOIDCLinkedIDsByIssuerRow struct

+ Count int32

+ IssuerPrefix string

Jun 12, 2026 GO-2026-5923

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

May 30, 2026 GO-2026-5906 +16 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 19, 2026 GO-2026-5906 +16 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 18, 2026 GO-2026-5906 +16 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2026-5906 +16 more

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 1, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type UpdateExternalAuthLinkRefreshTokenParams

+ OldOauthRefreshToken string

Apr 28, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 10, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type CountAuditLogsParams

+ CountCap int32

type CountConnectionLogsParams

+ CountCap int32

Mar 25, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 3, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 23, 2026 GO-2026-5169 +18 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 5, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 3, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 29, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 26, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 21, 2026 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 9, 2025 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 2, 2025 GO-2026-5169 +19 more

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AIBridgeInterception

+ APIKeyID sql.NullString

type GetPresetByIDRow

+ LastInvalidatedAt sql.NullTime

+ type GetTaskByOwnerIDAndNameParams struct

+ Name string

+ OwnerID uuid.UUID

type GetTemplatePresetsWithPrebuildsRow

+ LastInvalidatedAt sql.NullTime

type GetWorkspaceAgentAndLatestBuildByAuthTokenRow

+ TaskID uuid.NullUUID

type InsertAIBridgeInterceptionParams

+ APIKeyID sql.NullString

type InsertPresetParams

+ LastInvalidatedAt sql.NullTime

type InsertTaskParams

+ DisplayName string

type Task

+ DisplayName string

+ StatusDebug json.RawMessage

+ WorkspaceAgentLifecycleState NullWorkspaceAgentLifecycleState

+ WorkspaceAppHealth NullWorkspaceAppHealth

+ func (t Task) TaskTable() TaskTable

type TaskTable

+ DisplayName string

type Template

+ UseTerraformWorkspaceCache bool

type TemplateTable

+ UseTerraformWorkspaceCache bool

type TemplateVersionPreset

+ LastInvalidatedAt sql.NullTime

+ type UpdatePresetsLastInvalidatedAtParams struct

+ LastInvalidatedAt sql.NullTime

+ TemplateID uuid.UUID

+ type UpdatePresetsLastInvalidatedAtRow struct

+ TemplateName string

+ TemplateVersionName string

+ TemplateVersionPresetName string

+ type UpdateTaskPromptParams struct

+ ID uuid.UUID

+ Prompt string

type UpdateTemplateMetaByIDParams

+ UseTerraformWorkspaceCache bool

+ type UpdateUserTaskNotificationAlertDismissedParams struct

+ TaskNotificationAlertDismissed bool

+ UserID uuid.UUID

+ type WorkspaceIdentity struct

+ AutostartSchedule sql.NullString

+ ID uuid.UUID

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ OwnerUsername string

+ TemplateID uuid.UUID

+ TemplateName string

+ func WorkspaceIdentityFromWorkspace(w Workspace) WorkspaceIdentity

+ func (w WorkspaceIdentity) Equal(w2 WorkspaceIdentity) bool

+ func (w WorkspaceIdentity) IsPrebuild() bool

+ func (w WorkspaceIdentity) RBACObject() rbac.Object

Feb 23, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 3, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 29, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 26, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 20, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 9, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 1, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 27, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 12, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 11, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 10, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 4, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AIBridgeInterception

+ EndedAt sql.NullTime

type APIKey

+ func (k APIKey) ScopeSet() APIKeyScopeSet

type APIKeyScope

+ const ApiKeyScopeAibridgeInterception

+ const ApiKeyScopeApiKey

+ const ApiKeyScopeAssignOrgRole

+ const ApiKeyScopeAssignRole

+ const ApiKeyScopeAuditLog

+ const ApiKeyScopeConnectionLog

+ const ApiKeyScopeCryptoKey

+ const ApiKeyScopeDebugInfo

+ const ApiKeyScopeDeploymentConfig

+ const ApiKeyScopeDeploymentStats

+ const ApiKeyScopeFile

+ const ApiKeyScopeGroup

+ const ApiKeyScopeGroupMember

+ const ApiKeyScopeIdpsyncSettings

+ const ApiKeyScopeInboxNotification

+ const ApiKeyScopeLicense

+ const ApiKeyScopeNotificationMessage

+ const ApiKeyScopeNotificationPreference

+ const ApiKeyScopeNotificationTemplate

+ const ApiKeyScopeOauth2App

+ const ApiKeyScopeOauth2AppCodeToken

+ const ApiKeyScopeOauth2AppSecret

+ const ApiKeyScopeOrganization

+ const ApiKeyScopeOrganizationMember

+ const ApiKeyScopePrebuiltWorkspace

+ const ApiKeyScopeProvisionerDaemon

+ const ApiKeyScopeProvisionerJobs

+ const ApiKeyScopeReplicas

+ const ApiKeyScopeSystem

+ const ApiKeyScopeTailnetCoordinator

+ const ApiKeyScopeTask

+ const ApiKeyScopeTaskCreate

+ const ApiKeyScopeTaskDelete

+ const ApiKeyScopeTaskRead

+ const ApiKeyScopeTaskUpdate

+ const ApiKeyScopeTemplate

+ const ApiKeyScopeUsageEvent

+ const ApiKeyScopeUser

+ const ApiKeyScopeUserSecret

+ const ApiKeyScopeWebpushSubscription

+ const ApiKeyScopeWorkspace

+ const ApiKeyScopeWorkspaceAgentDevcontainers

+ const ApiKeyScopeWorkspaceAgentResourceMonitor

+ const ApiKeyScopeWorkspaceDormant

+ const ApiKeyScopeWorkspaceDormantShare

+ const ApiKeyScopeWorkspaceProxy

+ const ApiKeyScopeWorkspaceShare

+ type APIKeyScopeSet struct

+ AllowList AllowList

+ Scopes APIKeyScopes

+ func (s APIKeyScopeSet) Expand() (rbac.Scope, error)

+ func (s APIKeyScopeSet) Name() rbac.RoleIdentifier

type APIKeyScopes

+ func (s APIKeyScopes) WithAllowList(list AllowList) APIKeyScopeSet

+ type CalculateAIBridgeInterceptionsTelemetrySummaryParams struct

+ Client string

+ EndedAtAfter time.Time

+ EndedAtBefore time.Time

+ Model string

+ Provider string

+ type CalculateAIBridgeInterceptionsTelemetrySummaryRow struct

+ InjectedToolCallErrorCount int64

+ InterceptionCount int64

+ InterceptionDurationP50Millis int64

+ InterceptionDurationP90Millis int64

+ InterceptionDurationP95Millis int64

+ InterceptionDurationP99Millis int64

+ TokenCountCachedRead int64

+ TokenCountCachedWritten int64

+ TokenCountInput int64

+ TokenCountOutput int64

+ TokenUsagesCount int64

+ ToolCallsCountInjected int64

+ ToolCallsCountNonInjected int64

+ UniqueInitiatorCount int64

+ UserPromptsCount int64

type CheckConstraint

+ const CheckAPIKeysAllowListNotEmpty

+ const CheckTelemetryLockEventTypeConstraint

+ type CountAIBridgeInterceptionsParams struct

+ InitiatorID uuid.UUID

+ Model string

+ Provider string

+ StartedAfter time.Time

+ StartedBefore time.Time

+ type CountPendingNonActivePrebuildsRow struct

+ Count int32

+ PresetID uuid.NullUUID

+ type DeleteTaskParams struct

+ DeletedAt time.Time

+ ID uuid.UUID

type ForeignKeyConstraint

+ const ForeignKeyAibridgeInterceptionsInitiatorID

+ type GetOrganizationsWithPrebuildStatusParams struct

+ GroupName string

+ UserID uuid.UUID

+ type GetOrganizationsWithPrebuildStatusRow struct

+ HasPrebuildUser bool

+ HasPrebuildUserInGroup bool

+ OrganizationID uuid.UUID

+ OrganizationName string

+ PrebuildsGroupID uuid.NullUUID

type GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerParams

+ InitiatorID uuid.UUID

+ type GetWorkspaceAgentsForMetricsRow struct

+ OwnerUsername string

+ TemplateName string

+ TemplateVersionName sql.NullString

+ WorkspaceAgent WorkspaceAgent

+ WorkspaceID uuid.UUID

+ WorkspaceName string

+ type GetWorkspacesForWorkspaceMetricsRow struct

+ LatestBuildStatus ProvisionerJobStatus

+ LatestBuildTransition WorkspaceTransition

+ OwnerUsername string

+ TemplateName string

+ TemplateVersionName sql.NullString

type GetWorkspacesRow

+ TaskID uuid.NullUUID

+ type InsertTaskParams struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ Prompt string

+ TemplateParameters json.RawMessage

+ TemplateVersionID uuid.UUID

+ WorkspaceID uuid.NullUUID

+ type InsertTelemetryLockParams struct

+ EventType string

+ PeriodEndingAt time.Time

type ListAIBridgeInterceptionsParams

+ Offset int32

+ type ListAIBridgeInterceptionsRow struct

+ AIBridgeInterception AIBridgeInterception

+ VisibleUser VisibleUser

+ type ListAIBridgeInterceptionsTelemetrySummariesParams struct

+ EndedAtAfter time.Time

+ EndedAtBefore time.Time

+ type ListAIBridgeInterceptionsTelemetrySummariesRow struct

+ Client string

+ Model string

+ Provider string

+ type ListTasksParams struct

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ Status string

+ type NullTaskStatus struct

+ TaskStatus TaskStatus

+ Valid bool

+ func (ns *NullTaskStatus) Scan(value interface{}) error

+ func (ns NullTaskStatus) Value() (driver.Value, error)

type ResourceType

+ const ResourceTypeTask

type Task

+ OwnerAvatarUrl string

+ OwnerName string

+ OwnerUsername string

+ Status TaskStatus

+ WorkspaceAgentID uuid.NullUUID

+ WorkspaceAppID uuid.NullUUID

+ WorkspaceBuildNumber sql.NullInt32

+ func (t Task) RBACObject() rbac.Object

+ type TaskStatus string

+ const TaskStatusActive

+ const TaskStatusError

+ const TaskStatusInitializing

+ const TaskStatusPaused

+ const TaskStatusPending

+ const TaskStatusUnknown

+ func AllTaskStatusValues() []TaskStatus

+ func (e *TaskStatus) Scan(src interface{}) error

+ func (e TaskStatus) Valid() bool

+ type TaskTable struct

+ CreatedAt time.Time

+ DeletedAt sql.NullTime

+ ID uuid.UUID

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ Prompt string

+ TemplateParameters json.RawMessage

+ TemplateVersionID uuid.UUID

+ WorkspaceID uuid.NullUUID

+ func (t TaskTable) RBACObject() rbac.Object

type TaskWorkspaceApp

+ WorkspaceBuildNumber int32

+ type TelemetryLock struct

+ EventType string

+ PeriodEndingAt time.Time

type UniqueConstraint

+ const UniqueTaskWorkspaceAppsPkey

+ const UniqueTasksOwnerIDNameUniqueIndex

+ const UniqueTelemetryLocksPkey

+ type UpdateAIBridgeInterceptionEndedParams struct

+ EndedAt time.Time

+ ID uuid.UUID

+ type UpdatePrebuildProvisionerJobWithCancelParams struct

+ Now time.Time

+ PresetID uuid.NullUUID

+ type UpdatePrebuildProvisionerJobWithCancelRow struct

+ ID uuid.UUID

+ TemplateID uuid.UUID

+ TemplateVersionPresetID uuid.NullUUID

+ WorkspaceID uuid.UUID

+ type UpdateTaskWorkspaceIDParams struct

+ ID uuid.UUID

+ WorkspaceID uuid.NullUUID

+ type UpsertTaskWorkspaceAppParams struct

+ TaskID uuid.UUID

+ WorkspaceAgentID uuid.NullUUID

+ WorkspaceAppID uuid.NullUUID

+ WorkspaceBuildNumber int32

type Workspace

+ TaskID uuid.NullUUID

Jan 26, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 20, 2026 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 9, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 1, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 27, 2025 GO-2026-5897 +17 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 12, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 11, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 10, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 30, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 28, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 16, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 2, 2025 GO-2025-4182 +18 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type AIBridgeInterception struct

+ ID uuid.UUID

+ InitiatorID uuid.UUID

+ Metadata pqtype.NullRawMessage

+ Model string

+ Provider string

+ StartedAt time.Time

+ func (s AIBridgeInterception) RBACObject() rbac.Object

+ type AIBridgeTokenUsage struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ InputTokens int64

+ InterceptionID uuid.UUID

+ Metadata pqtype.NullRawMessage

+ OutputTokens int64

+ ProviderResponseID string

+ type AIBridgeToolUsage struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Injected bool

+ Input string

+ InterceptionID uuid.UUID

+ InvocationError sql.NullString

+ Metadata pqtype.NullRawMessage

+ ProviderResponseID string

+ ServerUrl sql.NullString

+ Tool string

+ type AIBridgeUserPrompt struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ InterceptionID uuid.UUID

+ Metadata pqtype.NullRawMessage

+ Prompt string

+ ProviderResponseID string

type APIKey

+ AllowList AllowList

+ Scopes APIKeyScopes

type APIKeyScope

+ const ApiKeyScopeAibridgeInterceptionCreate

+ const ApiKeyScopeAibridgeInterceptionRead

+ const ApiKeyScopeAibridgeInterceptionUpdate

+ const ApiKeyScopeApiKeyCreate

+ const ApiKeyScopeApiKeyDelete

+ const ApiKeyScopeApiKeyRead

+ const ApiKeyScopeApiKeyUpdate

+ const ApiKeyScopeAssignOrgRoleAssign

+ const ApiKeyScopeAssignOrgRoleCreate

+ const ApiKeyScopeAssignOrgRoleDelete

+ const ApiKeyScopeAssignOrgRoleRead

+ const ApiKeyScopeAssignOrgRoleUnassign

+ const ApiKeyScopeAssignOrgRoleUpdate

+ const ApiKeyScopeAssignRoleAssign

+ const ApiKeyScopeAssignRoleRead

+ const ApiKeyScopeAssignRoleUnassign

+ const ApiKeyScopeAuditLogCreate

+ const ApiKeyScopeAuditLogRead

+ const ApiKeyScopeCoderAll

+ const ApiKeyScopeCoderApikeysmanageSelf

+ const ApiKeyScopeCoderApplicationConnect

+ const ApiKeyScopeCoderTemplatesauthor

+ const ApiKeyScopeCoderTemplatesbuild

+ const ApiKeyScopeCoderWorkspacesaccess

+ const ApiKeyScopeCoderWorkspacescreate

+ const ApiKeyScopeCoderWorkspacesdelete

+ const ApiKeyScopeCoderWorkspacesoperate

+ const ApiKeyScopeConnectionLogRead

+ const ApiKeyScopeConnectionLogUpdate

+ const ApiKeyScopeCryptoKeyCreate

+ const ApiKeyScopeCryptoKeyDelete

+ const ApiKeyScopeCryptoKeyRead

+ const ApiKeyScopeCryptoKeyUpdate

+ const ApiKeyScopeDebugInfoRead

+ const ApiKeyScopeDeploymentConfigRead

+ const ApiKeyScopeDeploymentConfigUpdate

+ const ApiKeyScopeDeploymentStatsRead

+ const ApiKeyScopeFileCreate

+ const ApiKeyScopeFileRead

+ const ApiKeyScopeGroupCreate

+ const ApiKeyScopeGroupDelete

+ const ApiKeyScopeGroupMemberRead

+ const ApiKeyScopeGroupRead

+ const ApiKeyScopeGroupUpdate

+ const ApiKeyScopeIdpsyncSettingsRead

+ const ApiKeyScopeIdpsyncSettingsUpdate

+ const ApiKeyScopeInboxNotificationCreate

+ const ApiKeyScopeInboxNotificationRead

+ const ApiKeyScopeInboxNotificationUpdate

+ const ApiKeyScopeLicenseCreate

+ const ApiKeyScopeLicenseDelete

+ const ApiKeyScopeLicenseRead

+ const ApiKeyScopeNotificationMessageCreate

+ const ApiKeyScopeNotificationMessageDelete

+ const ApiKeyScopeNotificationMessageRead

+ const ApiKeyScopeNotificationMessageUpdate

+ const ApiKeyScopeNotificationPreferenceRead

+ const ApiKeyScopeNotificationPreferenceUpdate

+ const ApiKeyScopeNotificationTemplateRead

+ const ApiKeyScopeNotificationTemplateUpdate

+ const ApiKeyScopeOauth2AppCodeTokenCreate

+ const ApiKeyScopeOauth2AppCodeTokenDelete

+ const ApiKeyScopeOauth2AppCodeTokenRead

+ const ApiKeyScopeOauth2AppCreate

+ const ApiKeyScopeOauth2AppDelete

+ const ApiKeyScopeOauth2AppRead

+ const ApiKeyScopeOauth2AppSecretCreate

+ const ApiKeyScopeOauth2AppSecretDelete

+ const ApiKeyScopeOauth2AppSecretRead

+ const ApiKeyScopeOauth2AppSecretUpdate

+ const ApiKeyScopeOauth2AppUpdate

+ const ApiKeyScopeOrganizationCreate

+ const ApiKeyScopeOrganizationDelete

+ const ApiKeyScopeOrganizationMemberCreate

+ const ApiKeyScopeOrganizationMemberDelete

+ const ApiKeyScopeOrganizationMemberRead

+ const ApiKeyScopeOrganizationMemberUpdate

+ const ApiKeyScopeOrganizationRead

+ const ApiKeyScopeOrganizationUpdate

+ const ApiKeyScopePrebuiltWorkspaceDelete

+ const ApiKeyScopePrebuiltWorkspaceUpdate

+ const ApiKeyScopeProvisionerDaemonCreate

+ const ApiKeyScopeProvisionerDaemonDelete

+ const ApiKeyScopeProvisionerDaemonRead

+ const ApiKeyScopeProvisionerDaemonUpdate

+ const ApiKeyScopeProvisionerJobsCreate

+ const ApiKeyScopeProvisionerJobsRead

+ const ApiKeyScopeProvisionerJobsUpdate

+ const ApiKeyScopeReplicasRead

+ const ApiKeyScopeSystemCreate

+ const ApiKeyScopeSystemDelete

+ const ApiKeyScopeSystemRead

+ const ApiKeyScopeSystemUpdate

+ const ApiKeyScopeTailnetCoordinatorCreate

+ const ApiKeyScopeTailnetCoordinatorDelete

+ const ApiKeyScopeTailnetCoordinatorRead

+ const ApiKeyScopeTailnetCoordinatorUpdate

+ const ApiKeyScopeTemplateCreate

+ const ApiKeyScopeTemplateDelete

+ const ApiKeyScopeTemplateRead

+ const ApiKeyScopeTemplateUpdate

+ const ApiKeyScopeTemplateUse

+ const ApiKeyScopeTemplateViewInsights

+ const ApiKeyScopeUsageEventCreate

+ const ApiKeyScopeUsageEventRead

+ const ApiKeyScopeUsageEventUpdate

+ const ApiKeyScopeUserCreate

+ const ApiKeyScopeUserDelete

+ const ApiKeyScopeUserRead

+ const ApiKeyScopeUserReadPersonal

+ const ApiKeyScopeUserSecretCreate

+ const ApiKeyScopeUserSecretDelete

+ const ApiKeyScopeUserSecretRead

+ const ApiKeyScopeUserSecretUpdate

+ const ApiKeyScopeUserUpdate

+ const ApiKeyScopeUserUpdatePersonal

+ const ApiKeyScopeWebpushSubscriptionCreate

+ const ApiKeyScopeWebpushSubscriptionDelete

+ const ApiKeyScopeWebpushSubscriptionRead

+ const ApiKeyScopeWorkspaceAgentDevcontainersCreate

+ const ApiKeyScopeWorkspaceAgentResourceMonitorCreate

+ const ApiKeyScopeWorkspaceAgentResourceMonitorRead

+ const ApiKeyScopeWorkspaceAgentResourceMonitorUpdate

+ const ApiKeyScopeWorkspaceApplicationConnect

+ const ApiKeyScopeWorkspaceCreate

+ const ApiKeyScopeWorkspaceCreateAgent

+ const ApiKeyScopeWorkspaceDelete

+ const ApiKeyScopeWorkspaceDeleteAgent

+ const ApiKeyScopeWorkspaceDormantApplicationConnect

+ const ApiKeyScopeWorkspaceDormantCreate

+ const ApiKeyScopeWorkspaceDormantCreateAgent

+ const ApiKeyScopeWorkspaceDormantDelete

+ const ApiKeyScopeWorkspaceDormantDeleteAgent

+ const ApiKeyScopeWorkspaceDormantRead

+ const ApiKeyScopeWorkspaceDormantSsh

+ const ApiKeyScopeWorkspaceDormantStart

+ const ApiKeyScopeWorkspaceDormantStop

+ const ApiKeyScopeWorkspaceDormantUpdate

+ const ApiKeyScopeWorkspaceProxyCreate

+ const ApiKeyScopeWorkspaceProxyDelete

+ const ApiKeyScopeWorkspaceProxyRead

+ const ApiKeyScopeWorkspaceProxyUpdate

+ const ApiKeyScopeWorkspaceRead

+ const ApiKeyScopeWorkspaceSsh

+ const ApiKeyScopeWorkspaceStart

+ const ApiKeyScopeWorkspaceStop

+ const ApiKeyScopeWorkspaceUpdate

+ type APIKeyScopes []APIKeyScope

+ func (s *APIKeyScopes) Scan(src interface{}) error

+ func (s APIKeyScopes) Expand() (rbac.Scope, error)

+ func (s APIKeyScopes) Has(target APIKeyScope) bool

+ func (s APIKeyScopes) Name() rbac.RoleIdentifier

+ func (s APIKeyScopes) Value() (driver.Value, error)

+ type AllowList []AllowListTarget

+ func (a *AllowList) Scan(src any) error

+ func (a AllowList) Value() (driver.Value, error)

+ type AllowListTarget struct

+ ID string

+ Type string

+ func AllowListWildcard() AllowListTarget

+ func ParseAllowListTarget(s string) (AllowListTarget, error)

+ func (t AllowListTarget) String() string

type ForeignKeyConstraint

+ const ForeignKeyTaskWorkspaceAppsTaskID

+ const ForeignKeyTaskWorkspaceAppsWorkspaceAgentID

+ const ForeignKeyTaskWorkspaceAppsWorkspaceAppID

+ const ForeignKeyTaskWorkspaceAppsWorkspaceBuildID

+ const ForeignKeyTasksOrganizationID

+ const ForeignKeyTasksOwnerID

+ const ForeignKeyTasksTemplateVersionID

+ const ForeignKeyTasksWorkspaceID

type GetTemplatesWithFilterParams

+ ExactDisplayName string

+ FuzzyDisplayName string

type GetWorkspacesParams

+ Shared sql.NullBool

+ SharedWithGroupID uuid.UUID

+ SharedWithUserID uuid.UUID

+ type InsertAIBridgeInterceptionParams struct

+ ID uuid.UUID

+ InitiatorID uuid.UUID

+ Metadata json.RawMessage

+ Model string

+ Provider string

+ StartedAt time.Time

+ type InsertAIBridgeTokenUsageParams struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ InputTokens int64

+ InterceptionID uuid.UUID

+ Metadata json.RawMessage

+ OutputTokens int64

+ ProviderResponseID string

+ type InsertAIBridgeToolUsageParams struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Injected bool

+ Input string

+ InterceptionID uuid.UUID

+ InvocationError sql.NullString

+ Metadata json.RawMessage

+ ProviderResponseID string

+ ServerUrl sql.NullString

+ Tool string

+ type InsertAIBridgeUserPromptParams struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ InterceptionID uuid.UUID

+ Metadata json.RawMessage

+ Prompt string

+ ProviderResponseID string

type InsertAPIKeyParams

+ AllowList AllowList

+ Scopes APIKeyScopes

+ type ListAIBridgeInterceptionsParams struct

+ AfterID uuid.UUID

+ InitiatorID uuid.UUID

+ Limit int32

+ Model string

+ Provider string

+ StartedAfter time.Time

+ StartedBefore time.Time

type NotificationTemplateKind

+ const NotificationTemplateKindCustom

type OrganizationMembersParams

+ GithubUserID int64

type PaginatedOrganizationMembersParams

+ IncludeSystem bool

+ type Task struct

+ CreatedAt time.Time

+ DeletedAt sql.NullTime

+ ID uuid.UUID

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ Prompt string

+ TemplateParameters json.RawMessage

+ TemplateVersionID uuid.UUID

+ WorkspaceID uuid.NullUUID

+ type TaskWorkspaceApp struct

+ TaskID uuid.UUID

+ WorkspaceAgentID uuid.UUID

+ WorkspaceAppID uuid.UUID

+ WorkspaceBuildID uuid.UUID

type UniqueConstraint

+ const UniqueAibridgeInterceptionsPkey

+ const UniqueAibridgeTokenUsagesPkey

+ const UniqueAibridgeToolUsagesPkey

+ const UniqueAibridgeUserPromptsPkey

+ const UniqueTasksPkey

type UpsertWorkspaceAppParams

+ Tooltip string

type WorkspaceApp

+ Tooltip string

Dec 1, 2025 GO-2026-5897 +16 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type DeleteExpiredAPIKeysParams struct

+ Before time.Time

+ LimitCount int32

Nov 27, 2025 GO-2026-5897 +16 more

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 10, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 28, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 16, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 1, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 3, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ func IsCheckViolation(err error, checkConstraints ...CheckConstraint) bool

+ func IsProvisionerJobLogsLimitError(err error) bool

+ type CheckConstraint string

+ const CheckMaxLogsLength

+ const CheckMaxProvisionerLogsLength

+ const CheckOneTimePasscodeSet

+ const CheckSubsystemsNotNone

+ const CheckUsageEventTypeCheck

+ const CheckUsersUsernameMinLength

+ const CheckValidationMonotonicOrder

+ const CheckWorkspaceBuildsAiTaskSidebarAppIDRequired

+ const CheckWorkspaceBuildsDeadlineBelowMaxDeadline

type ClaimPrebuiltWorkspaceParams

+ AutostartSchedule sql.NullString

+ NextStartAt sql.NullTime

+ Now time.Time

+ WorkspaceTtl sql.NullInt64

+ type CorsBehavior string

+ const CorsBehaviorPassthru

+ const CorsBehaviorSimple

+ func AllCorsBehaviorValues() []CorsBehavior

+ func (e *CorsBehavior) Scan(src interface{}) error

+ func (e CorsBehavior) Valid() bool

+ type CreateUserSecretParams struct

+ Description string

+ EnvName string

+ FilePath string

+ ID uuid.UUID

+ Name string

+ UserID uuid.UUID

+ Value string

type ExternalAuthLink

+ OauthRefreshFailureReason string

+ type FindMatchingPresetIDParams struct

+ ParameterNames []string

+ ParameterValues []string

+ TemplateVersionID uuid.UUID

type ForeignKeyConstraint

+ const ForeignKeyUserSecretsUserID

type GetProvisionerDaemonsWithStatusByOrganizationParams

+ MaxAgeMs sql.NullInt64

+ Offline sql.NullBool

+ Statuses []ProvisionerDaemonStatus

+ type GetRegularWorkspaceCreateMetricsRow struct

+ CreatedCount int64

+ OrganizationName string

+ PresetName string

+ TemplateName string

type GetTemplatesWithFilterParams

+ AuthorID uuid.UUID

+ AuthorUsername string

+ HasExternalAgent sql.NullBool

+ type GetTotalUsageDCManagedAgentsV1Params struct

+ EndDate time.Time

+ StartDate time.Time

+ type GetUserSecretByUserIDAndNameParams struct

+ Name string

+ UserID uuid.UUID

+ type GetWorkspaceACLByIDRow struct

+ Groups WorkspaceACL

+ Users WorkspaceACL

type GetWorkspacesParams

+ HasExternalAgent sql.NullBool

type GetWorkspacesRow

+ GroupACL json.RawMessage

+ LatestBuildHasExternalAgent sql.NullBool

+ UserACL json.RawMessage

type InsertProvisionerJobParams

+ LogsOverflowed bool

type InsertTemplateParams

+ CorsBehavior CorsBehavior

+ type InsertUsageEventParams struct

+ CreatedAt time.Time

+ EventData json.RawMessage

+ EventType string

+ ID string

+ type NullCorsBehavior struct

+ CorsBehavior CorsBehavior

+ Valid bool

+ func (ns *NullCorsBehavior) Scan(value interface{}) error

+ func (ns NullCorsBehavior) Value() (driver.Value, error)

type ProvisionerJob

+ LogsLength int32

+ LogsOverflowed bool

type Template

+ CorsBehavior CorsBehavior

type TemplateTable

+ CorsBehavior CorsBehavior

type TemplateVersion

+ HasExternalAgent sql.NullBool

type TemplateVersionTable

+ HasExternalAgent sql.NullBool

type UniqueConstraint

+ const UniqueUsageEventsDailyPkey

+ const UniqueUsageEventsPkey

+ const UniqueUserSecretsPkey

+ const UniqueUserSecretsUserEnvNameIndex

+ const UniqueUserSecretsUserFilePathIndex

+ const UniqueUserSecretsUserNameIndex

type UpdateExternalAuthLinkRefreshTokenParams

+ OauthRefreshFailureReason string

+ type UpdateProvisionerJobLogsLengthParams struct

+ ID uuid.UUID

+ LogsLength int32

+ type UpdateProvisionerJobLogsOverflowedParams struct

+ ID uuid.UUID

+ LogsOverflowed bool

type UpdateTemplateMetaByIDParams

+ CorsBehavior CorsBehavior

+ type UpdateTemplateVersionFlagsByJobIDParams struct

+ HasAITask sql.NullBool

+ HasExternalAgent sql.NullBool

+ JobID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateUsageEventsPostPublishParams struct

+ FailureMessages []string

+ IDs []string

+ Now time.Time

+ SetPublishedAts []bool

+ type UpdateUserSecretParams struct

+ Description string

+ EnvName string

+ FilePath string

+ ID uuid.UUID

+ Value string

+ type UpdateWorkspaceACLByIDParams struct

+ GroupACL WorkspaceACL

+ ID uuid.UUID

+ UserACL WorkspaceACL

+ type UpdateWorkspaceBuildFlagsByIDParams struct

+ HasAITask sql.NullBool

+ HasExternalAgent sql.NullBool

+ ID uuid.UUID

+ SidebarAppID uuid.NullUUID

+ UpdatedAt time.Time

+ type UsageEvent struct

+ CreatedAt time.Time

+ EventData json.RawMessage

+ EventType string

+ FailureMessage sql.NullString

+ ID string

+ PublishStartedAt sql.NullTime

+ PublishedAt sql.NullTime

+ type UsageEventsDaily struct

+ Day time.Time

+ EventType string

+ UsageData json.RawMessage

+ type UserSecret struct

+ CreatedAt time.Time

+ Description string

+ EnvName string

+ FilePath string

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ Value string

+ func (s UserSecret) RBACObject() rbac.Object

+ type ValidateGroupIDsRow struct

+ InvalidGroupIds []uuid.UUID

+ Ok bool

+ type ValidateUserIDsRow struct

+ InvalidUserIds []uuid.UUID

+ Ok bool

type Workspace

+ GroupACL WorkspaceACL

+ UserACL WorkspaceACL

+ type WorkspaceACL map[string]WorkspaceACLEntry

+ func (t *WorkspaceACL) Scan(src interface{}) error

+ func (t WorkspaceACL) Value() (driver.Value, error)

+ func (w WorkspaceACL) RBACACL() map[string][]policy.Action

+ type WorkspaceACLEntry struct

+ Permissions []policy.Action

type WorkspaceBuild

+ HasExternalAgent sql.NullBool

type WorkspaceBuildTable

+ HasExternalAgent sql.NullBool

type WorkspaceTable

+ GroupACL WorkspaceACL

+ UserACL WorkspaceACL

Oct 1, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 3, 2025 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 7, 2025 GO-2025-3938 +18 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 5, 2025 GO-2025-3938 +18 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ func ParseIP(ipStr string) pqtype.Inet

type BuildReason

+ const BuildReasonCli

+ const BuildReasonDashboard

+ const BuildReasonJetbrainsConnection

+ const BuildReasonSshConnection

+ const BuildReasonVscodeConnection

+ type ConnectionLog struct

+ AgentName string

+ Code sql.NullInt32

+ ConnectTime time.Time

+ ConnectionID uuid.NullUUID

+ DisconnectReason sql.NullString

+ DisconnectTime sql.NullTime

+ ID uuid.UUID

+ Ip pqtype.Inet

+ OrganizationID uuid.UUID

+ SlugOrPort sql.NullString

+ Type ConnectionType

+ UserAgent sql.NullString

+ UserID uuid.NullUUID

+ WorkspaceID uuid.UUID

+ WorkspaceName string

+ WorkspaceOwnerID uuid.UUID

+ func (w ConnectionLog) RBACObject() rbac.Object

+ type ConnectionStatus string

+ const ConnectionStatusConnected

+ const ConnectionStatusDisconnected

+ func AllConnectionStatusValues() []ConnectionStatus

+ func (e *ConnectionStatus) Scan(src interface{}) error

+ func (e ConnectionStatus) Valid() bool

+ type ConnectionType string

+ const ConnectionTypeJetbrains

+ const ConnectionTypePortForwarding

+ const ConnectionTypeReconnectingPty

+ const ConnectionTypeSsh

+ const ConnectionTypeVscode

+ const ConnectionTypeWorkspaceApp

+ func AllConnectionTypeValues() []ConnectionType

+ func (e *ConnectionType) Scan(src interface{}) error

+ func (e ConnectionType) Valid() bool

+ type CountConnectionLogsParams struct

+ ConnectedAfter time.Time

+ ConnectedBefore time.Time

+ ConnectionID uuid.UUID

+ OrganizationID uuid.UUID

+ Status string

+ Type string

+ UserEmail string

+ UserID uuid.UUID

+ Username string

+ WorkspaceID uuid.UUID

+ WorkspaceOwner string

+ WorkspaceOwnerEmail string

+ WorkspaceOwnerID uuid.UUID

+ type DeleteOldAuditLogConnectionEventsParams struct

+ BeforeTime time.Time

+ LimitCount int32

type ForeignKeyConstraint

+ const ForeignKeyConnectionLogsOrganizationID

+ const ForeignKeyConnectionLogsWorkspaceID

+ const ForeignKeyConnectionLogsWorkspaceOwnerID

+ const ForeignKeyFkOauth2ProviderAppTokensUserID

+ type GetConnectionLogsOffsetParams struct

+ ConnectedAfter time.Time

+ ConnectedBefore time.Time

+ ConnectionID uuid.UUID

+ LimitOpt int32

+ OffsetOpt int32

+ OrganizationID uuid.UUID

+ Status string

+ Type string

+ UserEmail string

+ UserID uuid.UUID

+ Username string

+ WorkspaceID uuid.UUID

+ WorkspaceOwner string

+ WorkspaceOwnerEmail string

+ WorkspaceOwnerID uuid.UUID

+ type GetConnectionLogsOffsetRow struct

+ ConnectionLog ConnectionLog

+ OrganizationDisplayName string

+ OrganizationIcon string

+ OrganizationName string

+ UserAvatarUrl sql.NullString

+ UserCreatedAt sql.NullTime

+ UserDeleted sql.NullBool

+ UserEmail sql.NullString

+ UserLastSeenAt sql.NullTime

+ UserLoginType NullLoginType

+ UserName sql.NullString

+ UserQuietHoursSchedule sql.NullString

+ UserRoles pq.StringArray

+ UserStatus NullUserStatus

+ UserUpdatedAt sql.NullTime

+ UserUsername sql.NullString

+ WorkspaceOwnerUsername string

+ func (w GetConnectionLogsOffsetRow) RBACObject() rbac.Object

+ type GetManagedAgentCountParams struct

+ EndTime time.Time

+ StartTime time.Time

type GetPresetByIDRow

+ Description string

+ Icon string

type InsertOAuth2ProviderAppCodeParams

+ CodeChallenge sql.NullString

+ CodeChallengeMethod sql.NullString

+ ResourceUri sql.NullString

type InsertOAuth2ProviderAppParams

+ ClientIDIssuedAt sql.NullTime

+ ClientSecretExpiresAt sql.NullTime

+ ClientType sql.NullString

+ ClientUri sql.NullString

+ Contacts []string

+ DynamicallyRegistered sql.NullBool

+ GrantTypes []string

+ Jwks pqtype.NullRawMessage

+ JwksUri sql.NullString

+ LogoUri sql.NullString

+ PolicyUri sql.NullString

+ RedirectUris []string

+ RegistrationAccessToken sql.NullString

+ RegistrationClientUri sql.NullString

+ ResponseTypes []string

+ Scope sql.NullString

+ SoftwareID sql.NullString

+ SoftwareVersion sql.NullString

+ TokenEndpointAuthMethod sql.NullString

+ TosUri sql.NullString

type InsertOAuth2ProviderAppTokenParams

+ Audience sql.NullString

+ UserID uuid.UUID

type InsertPresetParams

+ Description string

+ Icon string

type InsertTemplateParams

+ UseClassicParameterFlow bool

+ type NullConnectionStatus struct

+ ConnectionStatus ConnectionStatus

+ Valid bool

+ func (ns *NullConnectionStatus) Scan(value interface{}) error

+ func (ns NullConnectionStatus) Value() (driver.Value, error)

+ type NullConnectionType struct

+ ConnectionType ConnectionType

+ Valid bool

+ func (ns *NullConnectionType) Scan(value interface{}) error

+ func (ns NullConnectionType) Value() (driver.Value, error)

type OAuth2ProviderApp

+ ClientIDIssuedAt sql.NullTime

+ ClientSecretExpiresAt sql.NullTime

+ ClientType sql.NullString

+ ClientUri sql.NullString

+ Contacts []string

+ DynamicallyRegistered sql.NullBool

+ GrantTypes []string

+ Jwks pqtype.NullRawMessage

+ JwksUri sql.NullString

+ LogoUri sql.NullString

+ PolicyUri sql.NullString

+ RedirectUris []string

+ RegistrationAccessToken sql.NullString

+ RegistrationClientUri sql.NullString

+ ResponseTypes []string

+ Scope sql.NullString

+ SoftwareID sql.NullString

+ SoftwareVersion sql.NullString

+ TokenEndpointAuthMethod sql.NullString

+ TosUri sql.NullString

type OAuth2ProviderAppCode

+ CodeChallenge sql.NullString

+ CodeChallengeMethod sql.NullString

+ ResourceUri sql.NullString

type OAuth2ProviderAppToken

+ Audience sql.NullString

+ UserID uuid.UUID

+ func (t OAuth2ProviderAppToken) RBACObject() rbac.Object

+ type PrebuildsSettings struct

+ ID uuid.UUID

+ ReconciliationPaused bool

type ResourceType

+ const ResourceTypePrebuildsSettings

type TemplateVersionPreset

+ Description string

+ Icon string

type UniqueConstraint

+ const UniqueConnectionLogsPkey

+ const UniqueIndexConnectionLogsConnectionIDWorkspaceIDAgentName

+ type UpdateOAuth2ProviderAppByClientIDParams struct

+ CallbackURL string

+ ClientSecretExpiresAt sql.NullTime

+ ClientType sql.NullString

+ ClientUri sql.NullString

+ Contacts []string

+ GrantTypes []string

+ ID uuid.UUID

+ Icon string

+ Jwks pqtype.NullRawMessage

+ JwksUri sql.NullString

+ LogoUri sql.NullString

+ Name string

+ PolicyUri sql.NullString

+ RedirectUris []string

+ ResponseTypes []string

+ Scope sql.NullString

+ SoftwareID sql.NullString

+ SoftwareVersion sql.NullString

+ TokenEndpointAuthMethod sql.NullString

+ TosUri sql.NullString

+ UpdatedAt time.Time

type UpdateOAuth2ProviderAppByIDParams

+ ClientSecretExpiresAt sql.NullTime

+ ClientType sql.NullString

+ ClientUri sql.NullString

+ Contacts []string

+ DynamicallyRegistered sql.NullBool

+ GrantTypes []string

+ Jwks pqtype.NullRawMessage

+ JwksUri sql.NullString

+ LogoUri sql.NullString

+ PolicyUri sql.NullString

+ RedirectUris []string

+ ResponseTypes []string

+ Scope sql.NullString

+ SoftwareID sql.NullString

+ SoftwareVersion sql.NullString

+ TokenEndpointAuthMethod sql.NullString

+ TosUri sql.NullString

+ type UpsertConnectionLogParams struct

+ AgentName string

+ Code sql.NullInt32

+ ConnectionID uuid.NullUUID

+ ConnectionStatus ConnectionStatus

+ DisconnectReason sql.NullString

+ ID uuid.UUID

+ Ip pqtype.Inet

+ OrganizationID uuid.UUID

+ SlugOrPort sql.NullString

+ Time time.Time

+ Type ConnectionType

+ UserAgent sql.NullString

+ UserID uuid.NullUUID

+ WorkspaceID uuid.UUID

+ WorkspaceName string

+ WorkspaceOwnerID uuid.UUID

May 14, 2026 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 13, 2026 GO-2025-4182 +17 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 4, 2025 GO-2025-4182 +19 more

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 7, 2025 GO-2025-3938 +20 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type CountAuditLogsParams struct

+ Action string

+ BuildReason string

+ DateFrom time.Time

+ DateTo time.Time

+ Email string

+ OrganizationID uuid.UUID

+ RequestID uuid.UUID

+ ResourceID uuid.UUID

+ ResourceTarget string

+ ResourceType string

+ UserID uuid.UUID

+ Username string

Jul 15, 2025 GO-2025-3938 +20 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 2, 2025 GO-2025-3938 +20 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 1, 2025 GO-2025-3938 +20 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ var PrebuildsSystemUserID = uuid.MustParse("c42fdf75-3097-471c-8c33-fb52454d81c0")

type AppSharingLevel

+ const AppSharingLevelOrganization

type ForeignKeyConstraint

+ const ForeignKeyTemplateVersionPresetPrebuildSchedulesPresetID

+ const ForeignKeyWorkspaceBuildsAiTaskSidebarAppID

type GetPresetByIDRow

+ IsDefault bool

+ SchedulingTimezone string

+ type GetProvisionerJobsByIDsWithQueuePositionParams struct

+ IDs []uuid.UUID

+ StaleIntervalMS int64

type GetTemplatePresetsWithPrebuildsRow

+ SchedulingTimezone string

type GetTemplatesWithFilterParams

+ HasAITask sql.NullBool

type GetWorkspacesEligibleForTransitionRow

+ BuildTemplateVersionID uuid.NullUUID

type GetWorkspacesParams

+ HasAITask sql.NullBool

type GetWorkspacesRow

+ LatestBuildHasAITask sql.NullBool

type InsertPresetParams

+ IsDefault bool

+ SchedulingTimezone string

+ type InsertPresetPrebuildScheduleParams struct

+ CronExpression string

+ DesiredInstances int32

+ PresetID uuid.UUID

type InsertTemplateVersionParameterParams

+ FormType ParameterFormType

+ type NullParameterFormType struct

+ ParameterFormType ParameterFormType

+ Valid bool

+ func (ns *NullParameterFormType) Scan(value interface{}) error

+ func (ns NullParameterFormType) Value() (driver.Value, error)

+ type ParameterFormType string

+ const ParameterFormTypeCheckbox

+ const ParameterFormTypeDropdown

+ const ParameterFormTypeError

+ const ParameterFormTypeInput

+ const ParameterFormTypeMultiSelect

+ const ParameterFormTypeRadio

+ const ParameterFormTypeSlider

+ const ParameterFormTypeSwitch

+ const ParameterFormTypeTagSelect

+ const ParameterFormTypeTextarea

+ const ParameterFormTypeValue0

+ func AllParameterFormTypeValues() []ParameterFormType

+ func (e *ParameterFormType) Scan(src interface{}) error

+ func (e ParameterFormType) Valid() bool

+ type PrebuiltWorkspaceResource interface

+ AsPrebuild func() rbac.Object

+ IsPrebuild func() bool

type TemplateVersion

+ HasAITask sql.NullBool

type TemplateVersionParameter

+ FormType ParameterFormType

type TemplateVersionPreset

+ IsDefault bool

+ SchedulingTimezone string

+ type TemplateVersionPresetPrebuildSchedule struct

+ CronExpression string

+ DesiredInstances int32

+ ID uuid.UUID

+ PresetID uuid.UUID

type TemplateVersionTable

+ HasAITask sql.NullBool

type UniqueConstraint

+ const UniqueIndexTemplateVersionPresetsDefault

+ const UniqueTemplateVersionPresetPrebuildSchedulesPkey

+ type UpdateTemplateVersionAITaskByJobIDParams struct

+ HasAITask sql.NullBool

+ JobID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateWorkspaceBuildAITaskByIDParams struct

+ HasAITask sql.NullBool

+ ID uuid.UUID

+ SidebarAppID uuid.NullUUID

+ UpdatedAt time.Time

+ type UpsertWorkspaceAppParams struct

+ AgentID uuid.UUID

+ Command sql.NullString

+ CreatedAt time.Time

+ DisplayGroup sql.NullString

+ DisplayName string

+ DisplayOrder int32

+ External bool

+ Health WorkspaceAppHealth

+ HealthcheckInterval int32

+ HealthcheckThreshold int32

+ HealthcheckUrl string

+ Hidden bool

+ ID uuid.UUID

+ Icon string

+ OpenIn WorkspaceAppOpenIn

+ SharingLevel AppSharingLevel

+ Slug string

+ Subdomain bool

+ Url sql.NullString

type Workspace

+ func (w Workspace) AsPrebuild() rbac.Object

+ func (w Workspace) IsPrebuild() bool

type WorkspaceAgent

+ Deleted bool

type WorkspaceAppStatusState

+ const WorkspaceAppStatusStateIdle

type WorkspaceBuild

+ AITaskSidebarAppID uuid.NullUUID

+ HasAITask sql.NullBool

type WorkspaceBuildTable

+ AITaskSidebarAppID uuid.NullUUID

+ HasAITask sql.NullBool

type WorkspaceTable

+ func (w WorkspaceTable) AsPrebuild() rbac.Object

+ func (w WorkspaceTable) IsPrebuild() bool

Aug 7, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 15, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 8, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 30, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 10, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 3, 2025 GO-2025-3938 +19 more

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type Chat

+ func (c Chat) RBACObject() rbac.Object

type GetPresetByIDRow

+ PrebuildStatus PrebuildStatus

+ type GetPresetsAtFailureLimitRow struct

+ PresetID uuid.UUID

+ TemplateVersionID uuid.UUID

type GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerRow

+ WorkerName string

+ type GetProvisionerJobsToBeReapedParams struct

+ HungSince time.Time

+ MaxJobs int32

+ PendingSince time.Time

type GetTemplatePresetsWithPrebuildsRow

+ OrganizationID uuid.UUID

+ PrebuildStatus PrebuildStatus

+ Ttl sql.NullInt32

type GetWorkspacesRow

+ OwnerName string

+ type InsertChatMessagesParams struct

+ ChatID uuid.UUID

+ Content json.RawMessage

+ CreatedAt time.Time

+ Model string

+ Provider string

+ type InsertChatParams struct

+ CreatedAt time.Time

+ OwnerID uuid.UUID

+ Title string

+ UpdatedAt time.Time

type InsertTemplateVersionTerraformValuesByJobIDParams

+ CachedModuleFiles uuid.NullUUID

+ ProvisionerdVersion string

type InsertWorkspaceAppParams

+ DisplayGroup sql.NullString

+ type NullPrebuildStatus struct

+ PrebuildStatus PrebuildStatus

+ Valid bool

+ func (ns *NullPrebuildStatus) Scan(value interface{}) error

+ func (ns NullPrebuildStatus) Value() (driver.Value, error)

+ type PrebuildStatus string

+ const PrebuildStatusHardLimited

+ const PrebuildStatusHealthy

+ const PrebuildStatusValidationFailed

+ func AllPrebuildStatusValues() []PrebuildStatus

+ func (e *PrebuildStatus) Scan(src interface{}) error

+ func (e PrebuildStatus) Valid() bool

type Template

+ CreatedByName string

+ UseClassicParameterFlow bool

type TemplateTable

+ UseClassicParameterFlow bool

type TemplateVersion

+ CreatedByName string

type TemplateVersionPreset

+ PrebuildStatus PrebuildStatus

+ type UpdateChatByIDParams struct

+ ID uuid.UUID

+ Title string

+ UpdatedAt time.Time

+ type UpdatePresetPrebuildStatusParams struct

+ PresetID uuid.UUID

+ Status PrebuildStatus

+ type UpdateProvisionerJobWithCompleteWithStartedAtByIDParams struct

+ CompletedAt sql.NullTime

+ Error sql.NullString

+ ErrorCode sql.NullString

+ ID uuid.UUID

+ StartedAt sql.NullTime

+ UpdatedAt time.Time

type UpdateTemplateMetaByIDParams

+ UseClassicParameterFlow bool

type VisibleUser

+ Name string

type Workspace

+ OwnerName string

type WorkspaceApp

+ DisplayGroup sql.NullString

type WorkspaceBuild

+ InitiatorByName string

May 20, 2025 GO-2025-3921 +20 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type Chat struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ OwnerID uuid.UUID

+ Title string

+ UpdatedAt time.Time

+ type ChatMessage struct

+ ChatID uuid.UUID

+ Content json.RawMessage

+ CreatedAt time.Time

+ ID int64

+ Model string

+ Provider string

type ForeignKeyConstraint

+ const ForeignKeyChatMessagesChatID

+ const ForeignKeyChatsOwnerID

+ const ForeignKeyTemplateVersionTerraformValuesCachedModuleFiles

+ const ForeignKeyWorkspaceAgentsParentID

type InsertWorkspaceAgentParams

+ ParentID uuid.NullUUID

type TemplateVersionTerraformValue

+ CachedModuleFiles uuid.NullUUID

+ ProvisionerdVersion string

type UniqueConstraint

+ const UniqueChatMessagesPkey

+ const UniqueChatsPkey

type WorkspaceAgent

+ ParentID uuid.NullUUID

May 15, 2025 GO-2025-3921 +20 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LockIDReconcilePrebuilds

+ type AgentKeyScopeEnum string

+ const AgentKeyScopeEnumAll

+ const AgentKeyScopeEnumNoUserData

+ func AllAgentKeyScopeEnumValues() []AgentKeyScopeEnum

+ func (e *AgentKeyScopeEnum) Scan(src interface{}) error

+ func (e AgentKeyScopeEnum) Valid() bool

+ type ClaimPrebuiltWorkspaceParams struct

+ NewName string

+ NewUserID uuid.UUID

+ PresetID uuid.UUID

+ type ClaimPrebuiltWorkspaceRow struct

+ ID uuid.UUID

+ Name string

+ type CountInProgressPrebuildsRow struct

+ Count int32

+ PresetID uuid.NullUUID

+ TemplateID uuid.UUID

+ TemplateVersionID uuid.UUID

+ Transition WorkspaceTransition

+ type GetPrebuildMetricsRow struct

+ ClaimedCount int64

+ CreatedCount int64

+ FailedCount int64

+ OrganizationName string

+ PresetName string

+ TemplateName string

+ type GetPresetByIDRow struct

+ CreatedAt time.Time

+ DesiredInstances sql.NullInt32

+ ID uuid.UUID

+ InvalidateAfterSecs sql.NullInt32

+ Name string

+ OrganizationID uuid.UUID

+ TemplateID uuid.NullUUID

+ TemplateVersionID uuid.UUID

+ type GetPresetsBackoffRow struct

+ LastBuildAt time.Time

+ NumFailed int32

+ PresetID uuid.UUID

+ TemplateVersionID uuid.UUID

+ type GetRunningPrebuiltWorkspacesRow struct

+ CreatedAt time.Time

+ CurrentPresetID uuid.NullUUID

+ ID uuid.UUID

+ Name string

+ Ready bool

+ TemplateID uuid.UUID

+ TemplateVersionID uuid.UUID

+ type GetTemplatePresetsWithPrebuildsRow struct

+ Deleted bool

+ Deprecated bool

+ DesiredInstances sql.NullInt32

+ ID uuid.UUID

+ Name string

+ OrganizationName string

+ TemplateID uuid.UUID

+ TemplateName string

+ TemplateVersionID uuid.UUID

+ TemplateVersionName string

+ UsingActiveVersion bool

type GetUsersParams

+ LoginType []LoginType

+ type GetWorkspaceAgentsByWorkspaceAndBuildNumberParams struct

+ BuildNumber int32

+ WorkspaceID uuid.UUID

type InsertPresetParams

+ DesiredInstances sql.NullInt32

+ ID uuid.UUID

+ InvalidateAfterSecs sql.NullInt32

type InsertWorkspaceAgentParams

+ APIKeyScope AgentKeyScopeEnum

+ type NullAgentKeyScopeEnum struct

+ AgentKeyScopeEnum AgentKeyScopeEnum

+ Valid bool

+ func (ns *NullAgentKeyScopeEnum) Scan(value interface{}) error

+ func (ns NullAgentKeyScopeEnum) Value() (driver.Value, error)

type TemplateVersionPreset

+ DesiredInstances sql.NullInt32

+ InvalidateAfterSecs sql.NullInt32

type UniqueConstraint

+ const UniqueIndexUniquePresetName

+ type UpdateUserTerminalFontParams struct

+ TerminalFont string

+ UserID uuid.UUID

+ type UpdateUserThemePreferenceParams struct

+ ThemePreference string

+ UserID uuid.UUID

type WorkspaceAgent

+ APIKeyScope AgentKeyScopeEnum

+ type WorkspaceLatestBuild struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ JobID uuid.UUID

+ JobStatus ProvisionerJobStatus

+ TemplateVersionID uuid.UUID

+ TemplateVersionPresetID uuid.NullUUID

+ Transition WorkspaceTransition

+ WorkspaceID uuid.UUID

+ type WorkspacePrebuild struct

+ CreatedAt time.Time

+ CurrentPresetID uuid.NullUUID

+ ID uuid.UUID

+ Name string

+ Ready bool

+ TemplateID uuid.UUID

+ type WorkspacePrebuildBuild struct

+ BuildNumber int32

+ ID uuid.UUID

+ JobID uuid.UUID

+ TemplateVersionID uuid.UUID

+ TemplateVersionPresetID uuid.NullUUID

+ Transition WorkspaceTransition

+ WorkspaceID uuid.UUID

Apr 29, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 24, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 23, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type GetFailedWorkspaceBuildsByTemplateIDRow

+ WorkspaceID uuid.UUID

Apr 2, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type DeleteWebpushSubscriptionByUserIDAndEndpointParams struct

+ Endpoint string

+ UserID uuid.UUID

type ForeignKeyConstraint

+ const ForeignKeyInboxNotificationsTemplateID

+ const ForeignKeyInboxNotificationsUserID

+ const ForeignKeyTemplateVersionTerraformValuesTemplateVersionID

+ const ForeignKeyUserConfigsUserID

+ const ForeignKeyWebpushSubscriptionsUserID

+ const ForeignKeyWorkspaceAgentDevcontainersWorkspaceAgentID

+ const ForeignKeyWorkspaceAppAuditSessionsAgentID

+ const ForeignKeyWorkspaceAppStatusesAgentID

+ const ForeignKeyWorkspaceAppStatusesAppID

+ const ForeignKeyWorkspaceAppStatusesWorkspaceID

+ type GetFilteredInboxNotificationsByUserIDParams struct

+ CreatedAtOpt time.Time

+ LimitOpt int32

+ ReadStatus InboxNotificationReadStatus

+ Targets []uuid.UUID

+ Templates []uuid.UUID

+ UserID uuid.UUID

+ type GetGroupMembersByGroupIDParams struct

+ GroupID uuid.UUID

+ IncludeSystem bool

+ type GetGroupMembersCountByGroupIDParams struct

+ GroupID uuid.UUID

+ IncludeSystem bool

+ type GetInboxNotificationsByUserIDParams struct

+ CreatedAtOpt time.Time

+ LimitOpt int32

+ ReadStatus InboxNotificationReadStatus

+ UserID uuid.UUID

+ type GetOrganizationResourceCountByIDRow struct

+ GroupCount int64

+ MemberCount int64

+ ProvisionerKeyCount int64

+ TemplateCount int64

+ WorkspaceCount int64

type GetProvisionerJobsByIDsWithQueuePositionRow

+ CreatedAt time.Time

+ ID uuid.UUID

type GetUsersParams

+ GithubComUserID int64

+ IncludeSystem bool

type GetUsersRow

+ IsSystem bool

+ type GetWebpushVAPIDKeysRow struct

+ VapidPrivateKey string

+ VapidPublicKey string

type GroupMember

+ UserIsSystem bool

+ type InboxNotification struct

+ Actions json.RawMessage

+ Content string

+ CreatedAt time.Time

+ ID uuid.UUID

+ Icon string

+ ReadAt sql.NullTime

+ Targets []uuid.UUID

+ TemplateID uuid.UUID

+ Title string

+ UserID uuid.UUID

+ func (i InboxNotification) RBACObject() rbac.Object

+ type InboxNotificationReadStatus string

+ const InboxNotificationReadStatusAll

+ const InboxNotificationReadStatusRead

+ const InboxNotificationReadStatusUnread

+ func AllInboxNotificationReadStatusValues() []InboxNotificationReadStatus

+ func (e *InboxNotificationReadStatus) Scan(src interface{}) error

+ func (e InboxNotificationReadStatus) Valid() bool

+ type InsertInboxNotificationParams struct

+ Actions json.RawMessage

+ Content string

+ CreatedAt time.Time

+ ID uuid.UUID

+ Icon string

+ Targets []uuid.UUID

+ TemplateID uuid.UUID

+ Title string

+ UserID uuid.UUID

+ type InsertTemplateVersionTerraformValuesByJobIDParams struct

+ CachedPlan json.RawMessage

+ JobID uuid.UUID

+ UpdatedAt time.Time

+ type InsertWebpushSubscriptionParams struct

+ CreatedAt time.Time

+ Endpoint string

+ EndpointAuthKey string

+ EndpointP256dhKey string

+ UserID uuid.UUID

+ type InsertWorkspaceAgentDevcontainersParams struct

+ ConfigPath []string

+ CreatedAt time.Time

+ ID []uuid.UUID

+ Name []string

+ WorkspaceAgentID uuid.UUID

+ WorkspaceFolder []string

+ type InsertWorkspaceAppStatusParams struct

+ AgentID uuid.UUID

+ AppID uuid.UUID

+ CreatedAt time.Time

+ ID uuid.UUID

+ Icon sql.NullString

+ Message string

+ NeedsUserAttention bool

+ State WorkspaceAppStatusState

+ Uri sql.NullString

+ WorkspaceID uuid.UUID

+ type MarkAllInboxNotificationsAsReadParams struct

+ ReadAt sql.NullTime

+ UserID uuid.UUID

type NotificationMethod

+ const NotificationMethodInbox

+ type NullInboxNotificationReadStatus struct

+ InboxNotificationReadStatus InboxNotificationReadStatus

+ Valid bool

+ func (ns *NullInboxNotificationReadStatus) Scan(value interface{}) error

+ func (ns NullInboxNotificationReadStatus) Value() (driver.Value, error)

+ type NullWorkspaceAppStatusState struct

+ Valid bool

+ WorkspaceAppStatusState WorkspaceAppStatusState

+ func (ns *NullWorkspaceAppStatusState) Scan(value interface{}) error

+ func (ns NullWorkspaceAppStatusState) Value() (driver.Value, error)

type OrganizationMembersParams

+ IncludeSystem bool

+ type PaginatedOrganizationMembersParams struct

+ LimitOpt int32

+ OffsetOpt int32

+ OrganizationID uuid.UUID

+ type PaginatedOrganizationMembersRow struct

+ AvatarURL string

+ Count int64

+ Email string

+ GlobalRoles pq.StringArray

+ Name string

+ OrganizationMember OrganizationMember

+ Username string

+ func (m PaginatedOrganizationMembersRow) RBACObject() rbac.Object

+ type TemplateVersionTerraformValue struct

+ CachedPlan json.RawMessage

+ TemplateVersionID uuid.UUID

+ UpdatedAt time.Time

type UniqueConstraint

+ const UniqueInboxNotificationsPkey

+ const UniqueTemplateVersionTerraformValuesTemplateVersionIDKey

+ const UniqueUserConfigsPkey

+ const UniqueWebpushSubscriptionsPkey

+ const UniqueWorkspaceAgentDevcontainersPkey

+ const UniqueWorkspaceAppAuditSessionsAgentIDAppIDUserIDIpUseKey

+ const UniqueWorkspaceAppAuditSessionsPkey

+ const UniqueWorkspaceAppAuditSessionsUniqueIndex

+ const UniqueWorkspaceAppStatusesPkey

+ type UpdateInboxNotificationReadStatusParams struct

+ ID uuid.UUID

+ ReadAt sql.NullTime

type UpdateUserAppearanceSettingsParams

+ UserID uuid.UUID

+ type UpsertWebpushVAPIDKeysParams struct

+ VapidPrivateKey string

+ VapidPublicKey string

+ type UpsertWorkspaceAppAuditSessionParams struct

+ AgentID uuid.UUID

+ AppID uuid.UUID

+ ID uuid.UUID

+ Ip string

+ SlugOrPort string

+ StaleIntervalMS int64

+ StartedAt time.Time

+ StatusCode int32

+ UpdatedAt time.Time

+ UserAgent string

+ UserID uuid.UUID

type User

+ IsSystem bool

+ type UserConfig struct

+ Key string

+ UserID uuid.UUID

+ Value string

+ type WebpushSubscription struct

+ CreatedAt time.Time

+ Endpoint string

+ EndpointAuthKey string

+ EndpointP256dhKey string

+ ID uuid.UUID

+ UserID uuid.UUID

+ type WorkspaceAgentDevcontainer struct

+ ConfigPath string

+ CreatedAt time.Time

+ ID uuid.UUID

+ Name string

+ WorkspaceAgentID uuid.UUID

+ WorkspaceFolder string

+ type WorkspaceAppAuditSession struct

+ AgentID uuid.UUID

+ AppID uuid.UUID

+ ID uuid.UUID

+ Ip string

+ SlugOrPort string

+ StartedAt time.Time

+ StatusCode int32

+ UpdatedAt time.Time

+ UserAgent string

+ UserID uuid.UUID

+ type WorkspaceAppStatus struct

+ AgentID uuid.UUID

+ AppID uuid.UUID

+ CreatedAt time.Time

+ ID uuid.UUID

+ Icon sql.NullString

+ Message string

+ NeedsUserAttention bool

+ State WorkspaceAppStatusState

+ Uri sql.NullString

+ WorkspaceID uuid.UUID

+ type WorkspaceAppStatusState string

+ const WorkspaceAppStatusStateComplete

+ const WorkspaceAppStatusStateFailure

+ const WorkspaceAppStatusStateWorking

+ func AllWorkspaceAppStatusStateValues() []WorkspaceAppStatusState

+ func (e *WorkspaceAppStatusState) Scan(src interface{}) error

+ func (e WorkspaceAppStatusState) Valid() bool

Apr 29, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 17, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 15, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 4, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AuditAction

+ const AuditActionClose

+ const AuditActionConnect

+ const AuditActionDisconnect

+ const AuditActionOpen

type ForeignKeyConstraint

+ const ForeignKeyTemplateVersionPresetParametTemplateVersionPresetID

+ const ForeignKeyTemplateVersionPresetsTemplateVersionID

+ const ForeignKeyWorkspaceAgentMemoryResourceMonitorsAgentID

+ const ForeignKeyWorkspaceAgentVolumeResourceMonitorsAgentID

+ const ForeignKeyWorkspaceBuildsTemplateVersionPresetID

type GetAuditLogsOffsetParams

+ RequestID uuid.UUID

+ type GetOrganizationByNameParams struct

+ Deleted bool

+ Name string

+ type GetOrganizationsByUserIDParams struct

+ Deleted bool

+ UserID uuid.UUID

type GetOrganizationsParams

+ Deleted bool

type GetProvisionerDaemonsWithStatusByOrganizationParams

+ Limit sql.NullInt32

type GetProvisionerDaemonsWithStatusByOrganizationRow

+ CurrentJobTemplateDisplayName string

+ CurrentJobTemplateIcon string

+ CurrentJobTemplateName string

+ PreviousJobTemplateDisplayName string

+ PreviousJobTemplateIcon string

+ PreviousJobTemplateName string

type GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerParams

+ Tags StringMap

type GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerRow

+ TemplateDisplayName string

+ TemplateID uuid.NullUUID

+ TemplateIcon string

+ TemplateName string

+ TemplateVersionName string

+ WorkspaceID uuid.NullUUID

+ WorkspaceName string

+ type InsertMemoryResourceMonitorParams struct

+ AgentID uuid.UUID

+ CreatedAt time.Time

+ DebouncedUntil time.Time

+ Enabled bool

+ State WorkspaceAgentMonitorState

+ Threshold int32

+ UpdatedAt time.Time

+ type InsertPresetParametersParams struct

+ Names []string

+ TemplateVersionPresetID uuid.UUID

+ Values []string

+ type InsertPresetParams struct

+ CreatedAt time.Time

+ Name string

+ TemplateVersionID uuid.UUID

+ type InsertVolumeResourceMonitorParams struct

+ AgentID uuid.UUID

+ CreatedAt time.Time

+ DebouncedUntil time.Time

+ Enabled bool

+ Path string

+ State WorkspaceAgentMonitorState

+ Threshold int32

+ UpdatedAt time.Time

type InsertWorkspaceBuildParams

+ TemplateVersionPresetID uuid.NullUUID

+ type NullWorkspaceAgentMonitorState struct

+ Valid bool

+ WorkspaceAgentMonitorState WorkspaceAgentMonitorState

+ func (ns *NullWorkspaceAgentMonitorState) Scan(value interface{}) error

+ func (ns NullWorkspaceAgentMonitorState) Value() (driver.Value, error)

type Organization

+ Deleted bool

type ResourceType

+ const ResourceTypeWorkspaceAgent

+ const ResourceTypeWorkspaceApp

+ type TemplateVersionPreset struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Name string

+ TemplateVersionID uuid.UUID

+ type TemplateVersionPresetParameter struct

+ ID uuid.UUID

+ Name string

+ TemplateVersionPresetID uuid.UUID

+ Value string

type UniqueConstraint

+ const UniqueTemplateVersionPresetParametersPkey

+ const UniqueTemplateVersionPresetsPkey

+ const UniqueWorkspaceAgentMemoryResourceMonitorsPkey

+ const UniqueWorkspaceAgentVolumeResourceMonitorsPkey

+ type UpdateMemoryResourceMonitorParams struct

+ AgentID uuid.UUID

+ DebouncedUntil time.Time

+ State WorkspaceAgentMonitorState

+ UpdatedAt time.Time

+ type UpdateOrganizationDeletedByIDParams struct

+ ID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateVolumeResourceMonitorParams struct

+ AgentID uuid.UUID

+ DebouncedUntil time.Time

+ Path string

+ State WorkspaceAgentMonitorState

+ UpdatedAt time.Time

+ type WorkspaceAgentMemoryResourceMonitor struct

+ AgentID uuid.UUID

+ CreatedAt time.Time

+ DebouncedUntil time.Time

+ Enabled bool

+ State WorkspaceAgentMonitorState

+ Threshold int32

+ UpdatedAt time.Time

+ func (m WorkspaceAgentMemoryResourceMonitor) Debounce(by time.Duration, now time.Time, oldState, newState WorkspaceAgentMonitorState) (time.Time, bool)

+ type WorkspaceAgentMonitorState string

+ const WorkspaceAgentMonitorStateNOK

+ const WorkspaceAgentMonitorStateOK

+ func AllWorkspaceAgentMonitorStateValues() []WorkspaceAgentMonitorState

+ func (e *WorkspaceAgentMonitorState) Scan(src interface{}) error

+ func (e WorkspaceAgentMonitorState) Valid() bool

+ type WorkspaceAgentVolumeResourceMonitor struct

+ AgentID uuid.UUID

+ CreatedAt time.Time

+ DebouncedUntil time.Time

+ Enabled bool

+ Path string

+ State WorkspaceAgentMonitorState

+ Threshold int32

+ UpdatedAt time.Time

+ func (m WorkspaceAgentVolumeResourceMonitor) Debounce(by time.Duration, now time.Time, oldState, newState WorkspaceAgentMonitorState) (debouncedUntil time.Time, shouldNotify bool)

type WorkspaceBuild

+ TemplateVersionPresetID uuid.NullUUID

type WorkspaceBuildTable

+ TemplateVersionPresetID uuid.NullUUID

Apr 29, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 23, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type GetAuthorizationUserRolesRow

+ Email string

Mar 6, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 4, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type BatchUpdateWorkspaceNextStartAtParams struct

+ IDs []uuid.UUID

+ NextStartAts []time.Time

type ForeignKeyConstraint

+ const ForeignKeyUserDeletedUserID

+ const ForeignKeyUserStatusChangesUserID

+ type GetProvisionerDaemonsWithStatusByOrganizationParams struct

+ IDs []uuid.UUID

+ OrganizationID uuid.UUID

+ StaleIntervalMS int64

+ Tags StringMap

+ type GetProvisionerDaemonsWithStatusByOrganizationRow struct

+ CurrentJobID uuid.NullUUID

+ CurrentJobStatus NullProvisionerJobStatus

+ KeyName string

+ PreviousJobID uuid.NullUUID

+ PreviousJobStatus NullProvisionerJobStatus

+ ProvisionerDaemon ProvisionerDaemon

+ Status ProvisionerDaemonStatus

+ func (p GetProvisionerDaemonsWithStatusByOrganizationRow) RBACObject() rbac.Object

+ type GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerParams struct

+ IDs []uuid.UUID

+ Limit sql.NullInt32

+ OrganizationID uuid.NullUUID

+ Status []ProvisionerJobStatus

+ type GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerRow struct

+ AvailableWorkers []uuid.UUID

+ ProvisionerJob ProvisionerJob

+ QueuePosition int64

+ QueueSize int64

+ func (r GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerRow) RBACObject() rbac.Object

+ type GetUserStatusCountsParams struct

+ EndTime time.Time

+ Interval int32

+ StartTime time.Time

+ type GetUserStatusCountsRow struct

+ Count int64

+ Date time.Time

+ Status UserStatus

type GetUsersParams

+ CreatedAfter time.Time

+ CreatedBefore time.Time

type GetWorkspacesRow

+ NextStartAt sql.NullTime

+ type InsertTelemetryItemIfNotExistsParams struct

+ Key string

+ Value string

type InsertWorkspaceAppParams

+ OpenIn WorkspaceAppOpenIn

type InsertWorkspaceParams

+ NextStartAt sql.NullTime

type NotificationTemplate

+ EnabledByDefault bool

+ type NullProvisionerDaemonStatus struct

+ ProvisionerDaemonStatus ProvisionerDaemonStatus

+ Valid bool

+ func (ns *NullProvisionerDaemonStatus) Scan(value interface{}) error

+ func (ns NullProvisionerDaemonStatus) Value() (driver.Value, error)

+ type NullWorkspaceAppOpenIn struct

+ Valid bool

+ WorkspaceAppOpenIn WorkspaceAppOpenIn

+ func (ns *NullWorkspaceAppOpenIn) Scan(value interface{}) error

+ func (ns NullWorkspaceAppOpenIn) Value() (driver.Value, error)

+ type ProvisionerDaemonStatus string

+ const ProvisionerDaemonStatusBusy

+ const ProvisionerDaemonStatusIdle

+ const ProvisionerDaemonStatusOffline

+ func AllProvisionerDaemonStatusValues() []ProvisionerDaemonStatus

+ func (e *ProvisionerDaemonStatus) Scan(src interface{}) error

+ func (e ProvisionerDaemonStatus) Valid() bool

type ProvisionerJob

+ func (p ProvisionerJob) RBACObject() rbac.Object

type ResourceType

+ const ResourceTypeIdpSyncSettingsGroup

+ const ResourceTypeIdpSyncSettingsOrganization

+ const ResourceTypeIdpSyncSettingsRole

+ type TelemetryItem struct

+ CreatedAt time.Time

+ Key string

+ UpdatedAt time.Time

+ Value string

type UniqueConstraint

+ const UniqueTelemetryItemsPkey

+ const UniqueUserDeletedPkey

+ const UniqueUserStatusChangesPkey

type UpdateWorkspaceAutostartParams

+ NextStartAt sql.NullTime

+ type UpdateWorkspaceNextStartAtParams struct

+ ID uuid.UUID

+ NextStartAt sql.NullTime

+ type UpdateWorkspacesTTLByTemplateIDParams struct

+ TemplateID uuid.UUID

+ Ttl sql.NullInt64

+ type UpsertTelemetryItemParams struct

+ Key string

+ Value string

+ type UserDeleted struct

+ DeletedAt time.Time

+ ID uuid.UUID

+ UserID uuid.UUID

+ type UserStatusChange struct

+ ChangedAt time.Time

+ ID uuid.UUID

+ NewStatus UserStatus

+ UserID uuid.UUID

type Workspace

+ NextStartAt sql.NullTime

type WorkspaceApp

+ OpenIn WorkspaceAppOpenIn

+ type WorkspaceAppOpenIn string

+ const WorkspaceAppOpenInSlimWindow

+ const WorkspaceAppOpenInTab

+ const WorkspaceAppOpenInWindow

+ func AllWorkspaceAppOpenInValues() []WorkspaceAppOpenIn

+ func (e *WorkspaceAppOpenIn) Scan(src interface{}) error

+ func (e WorkspaceAppOpenIn) Valid() bool

type WorkspaceTable

+ NextStartAt sql.NullTime

Jan 29, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 23, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 18, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 7, 2025 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 16, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type GetEligibleProvisionerDaemonsByProvisionerJobIDsRow struct

+ JobID uuid.UUID

+ ProvisionerDaemon ProvisionerDaemon

+ func (p GetEligibleProvisionerDaemonsByProvisionerJobIDsRow) RBACObject() rbac.Object

Dec 3, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AcquireProvisionerJobParams

+ ProvisionerTags json.RawMessage

+ type AgentIDNamePair struct

+ ID uuid.UUID

+ Name string

+ func (p *AgentIDNamePair) Scan(src interface{}) error

+ func (p AgentIDNamePair) Value() (driver.Value, error)

type ForeignKeyConstraint

+ const ForeignKeyWorkspaceModulesJobID

+ type GetProvisionerDaemonsByOrganizationParams struct

+ OrganizationID uuid.UUID

+ WantTags StringMap

type GetWorkspaceAgentScriptTimingsByBuildIDRow

+ WorkspaceAgentID uuid.UUID

+ WorkspaceAgentName string

+ type GetWorkspacesAndAgentsByOwnerIDRow struct

+ Agents []AgentIDNamePair

+ ID uuid.UUID

+ JobStatus ProvisionerJobStatus

+ Name string

+ Transition WorkspaceTransition

+ type GetWorkspacesEligibleForTransitionRow struct

+ ID uuid.UUID

+ Name string

type InsertTemplateVersionParams

+ SourceExampleID sql.NullString

type InsertUserLinkParams

+ Claims UserLinkClaims

+ type InsertWorkspaceModuleParams struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ JobID uuid.UUID

+ Key string

+ Source string

+ Transition WorkspaceTransition

+ Version string

type InsertWorkspaceResourceParams

+ ModulePath sql.NullString

+ type OIDCClaimFieldValuesParams struct

+ ClaimField string

+ OrganizationID uuid.UUID

type TemplateVersion

+ SourceExampleID sql.NullString

type TemplateVersionTable

+ SourceExampleID sql.NullString

+ type UpdateExternalAuthLinkRefreshTokenParams struct

+ OAuthRefreshToken string

+ OAuthRefreshTokenKeyID string

+ ProviderID string

+ UpdatedAt time.Time

+ UserID uuid.UUID

type UpdateUserLinkParams

+ Claims UserLinkClaims

type UserLink

+ Claims UserLinkClaims

+ type UserLinkClaims struct

+ IDTokenClaims map[string]interface{}

+ MergedClaims map[string]interface{}

+ UserInfoClaims map[string]interface{}

+ func (a *UserLinkClaims) Scan(src interface{}) error

+ func (a UserLinkClaims) Value() (driver.Value, error)

+ type WorkspaceModule struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ JobID uuid.UUID

+ Key string

+ Source string

+ Transition WorkspaceTransition

+ Version string

type WorkspaceResource

+ ModulePath sql.NullString

Dec 12, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 8, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 8, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Nov 4, 2024 GO-2025-3921 +19 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ func IncrementExecutionCount(opts *TxOptions)

+ func WithSerialRetryCount(count int) func(*sqlQuerier)

type AuditAction

+ const AuditActionRequestPasswordReset

type CryptoKey

+ func (k CryptoKey) CanSign(now time.Time) bool

+ func (k CryptoKey) CanVerify(now time.Time) bool

+ func (k CryptoKey) DecodeString() ([]byte, error)

type CryptoKeyFeature

+ const CryptoKeyFeatureOIDCConvert

+ const CryptoKeyFeatureWorkspaceAppsAPIKey

+ const CryptoKeyFeatureWorkspaceAppsToken

type GetWorkspaceAgentAndLatestBuildByAuthTokenRow

+ WorkspaceTable WorkspaceTable

+ type GetWorkspaceAgentScriptTimingsByBuildIDRow struct

+ DisplayName string

+ EndedAt time.Time

+ ExitCode int32

+ ScriptID uuid.UUID

+ Stage WorkspaceAgentScriptTimingStage

+ StartedAt time.Time

+ Status WorkspaceAgentScriptTimingStatus

type GetWorkspacesRow

+ OrganizationDescription string

+ OrganizationDisplayName string

+ OrganizationIcon string

+ OrganizationName string

+ OwnerAvatarUrl string

+ OwnerUsername string

+ TemplateDescription string

+ TemplateDisplayName string

+ TemplateIcon string

type InsertUserParams

+ Status string

+ type PGLock struct

+ ClassID *string

+ Database *string

+ FastPath *bool

+ Granted bool

+ LockType *string

+ Mode *string

+ ObjID *string

+ ObjSubID *int

+ PID int

+ Page *int

+ Relation *string

+ RelationName *string

+ TransactionID *string

+ Tuple *int

+ VirtualTransaction *string

+ VirtualXID *string

+ WaitStart *time.Time

+ func (l PGLock) Equal(b PGLock) bool

+ func (l PGLock) String() string

+ type PGLocks []PGLock

+ func (l PGLocks) Difference(to PGLocks) (new PGLocks, removed PGLocks)

+ func (l PGLocks) String() string

type Store

+ PGLocks func(ctx context.Context) (PGLocks, error)

+ type TxOptions struct

+ Isolation sql.IsolationLevel

+ ReadOnly bool

+ TxIdentifier string

+ func DefaultTXOptions() *TxOptions

+ func (o *TxOptions) WithID(id string) *TxOptions

+ func (o TxOptions) ExecutionCount() int

type UpdateInactiveUsersToDormantRow

+ Username string

+ type UpdateUserHashedOneTimePasscodeParams struct

+ HashedOneTimePasscode []byte

+ ID uuid.UUID

+ OneTimePasscodeExpiresAt sql.NullTime

type Workspace

+ OrganizationDescription string

+ OrganizationDisplayName string

+ OrganizationIcon string

+ OrganizationName string

+ OwnerAvatarUrl string

+ OwnerUsername string

+ TemplateDescription string

+ TemplateDisplayName string

+ TemplateIcon string

+ TemplateName string

+ func (w Workspace) WorkspaceTable() WorkspaceTable

+ type WorkspaceTable struct

+ AutomaticUpdates AutomaticUpdates

+ AutostartSchedule sql.NullString

+ CreatedAt time.Time

+ Deleted bool

+ DeletingAt sql.NullTime

+ DormantAt sql.NullTime

+ Favorite bool

+ ID uuid.UUID

+ LastUsedAt time.Time

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ TemplateID uuid.UUID

+ Ttl sql.NullInt64

+ UpdatedAt time.Time

+ func (w WorkspaceTable) DormantRBAC() rbac.Object

+ func (w WorkspaceTable) RBACObject() rbac.Object

Oct 24, 2024 GO-2025-3921 +18 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 1, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LockIDCryptoKeyRotation

+ const LockIDNotificationsReportGenerator

+ type CryptoKey struct

+ DeletesAt sql.NullTime

+ Feature CryptoKeyFeature

+ Secret sql.NullString

+ SecretKeyID sql.NullString

+ Sequence int32

+ StartsAt time.Time

+ func (k CryptoKey) ExpiresAt(keyDuration time.Duration) time.Time

+ type CryptoKeyFeature string

+ const CryptoKeyFeatureOidcConvert

+ const CryptoKeyFeatureTailnetResume

+ const CryptoKeyFeatureWorkspaceApps

+ func AllCryptoKeyFeatureValues() []CryptoKeyFeature

+ func (e *CryptoKeyFeature) Scan(src interface{}) error

+ func (e CryptoKeyFeature) Valid() bool

+ type DeleteCryptoKeyParams struct

+ Feature CryptoKeyFeature

+ Sequence int32

type FetchNewMessageMetadataRow

+ NotificationTemplateID uuid.UUID

type ForeignKeyConstraint

+ const ForeignKeyCryptoKeysSecretKeyID

+ const ForeignKeyProvisionerDaemonsKeyID

+ const ForeignKeyWorkspaceAgentScriptTimingsScriptID

+ type GetCryptoKeyByFeatureAndSequenceParams struct

+ Feature CryptoKeyFeature

+ Sequence int32

+ type GetDeploymentWorkspaceAgentUsageStatsRow struct

+ SessionCountJetBrains int64

+ SessionCountReconnectingPTY int64

+ SessionCountSSH int64

+ SessionCountVSCode int64

+ WorkspaceConnectionLatency50 float64

+ WorkspaceConnectionLatency95 float64

+ WorkspaceRxBytes int64

+ WorkspaceTxBytes int64

+ type GetFailedWorkspaceBuildsByTemplateIDParams struct

+ Since time.Time

+ TemplateID uuid.UUID

+ type GetFailedWorkspaceBuildsByTemplateIDRow struct

+ TemplateVersionName string

+ WorkspaceBuildNumber int32

+ WorkspaceName string

+ WorkspaceOwnerUsername string

type GetGroupsParams

+ GroupIds []uuid.UUID

+ GroupNames []string

type GetUsersRow

+ HashedOneTimePasscode []byte

+ MustResetPassword bool

+ OneTimePasscodeExpiresAt sql.NullTime

+ type GetWorkspaceAgentUsageStatsAndLabelsRow struct

+ AgentName string

+ ConnectionCount int64

+ ConnectionMedianLatencyMS float64

+ RxBytes int64

+ SessionCountJetBrains int64

+ SessionCountReconnectingPTY int64

+ SessionCountSSH int64

+ SessionCountVSCode int64

+ TxBytes int64

+ Username string

+ WorkspaceName string

+ type GetWorkspaceAgentUsageStatsRow struct

+ AgentID uuid.UUID

+ AgentID_2 uuid.UUID

+ AggregatedFrom time.Time

+ SessionCountJetBrains int64

+ SessionCountReconnectingPTY int64

+ SessionCountSSH int64

+ SessionCountVSCode int64

+ TemplateID uuid.UUID

+ UserID uuid.UUID

+ WorkspaceConnectionLatency50 float64

+ WorkspaceConnectionLatency95 float64

+ WorkspaceID uuid.UUID

+ WorkspaceRxBytes int64

+ WorkspaceTxBytes int64

+ type GetWorkspaceBuildStatsByTemplatesRow struct

+ FailedBuilds int64

+ TemplateDisplayName string

+ TemplateID uuid.UUID

+ TemplateName string

+ TemplateOrganizationID uuid.UUID

+ TotalBuilds int64

+ type InsertCryptoKeyParams struct

+ Feature CryptoKeyFeature

+ Secret sql.NullString

+ SecretKeyID sql.NullString

+ Sequence int32

+ StartsAt time.Time

+ type InsertUserGroupsByIDParams struct

+ GroupIds []uuid.UUID

+ UserID uuid.UUID

+ type InsertWorkspaceAgentScriptTimingsParams struct

+ EndedAt time.Time

+ ExitCode int32

+ ScriptID uuid.UUID

+ Stage WorkspaceAgentScriptTimingStage

+ StartedAt time.Time

+ Status WorkspaceAgentScriptTimingStatus

type InsertWorkspaceAgentScriptsParams

+ DisplayName []string

+ ID []uuid.UUID

type InsertWorkspaceAgentStatsParams

+ Usage []bool

type InsertWorkspaceAppParams

+ Hidden bool

+ type NotificationReportGeneratorLog struct

+ LastGeneratedAt time.Time

+ NotificationTemplateID uuid.UUID

+ type NullCryptoKeyFeature struct

+ CryptoKeyFeature CryptoKeyFeature

+ Valid bool

+ func (ns *NullCryptoKeyFeature) Scan(value interface{}) error

+ func (ns NullCryptoKeyFeature) Value() (driver.Value, error)

+ type NullWorkspaceAgentScriptTimingStage struct

+ Valid bool

+ WorkspaceAgentScriptTimingStage WorkspaceAgentScriptTimingStage

+ func (ns *NullWorkspaceAgentScriptTimingStage) Scan(value interface{}) error

+ func (ns NullWorkspaceAgentScriptTimingStage) Value() (driver.Value, error)

+ type NullWorkspaceAgentScriptTimingStatus struct

+ Valid bool

+ WorkspaceAgentScriptTimingStatus WorkspaceAgentScriptTimingStatus

+ func (ns *NullWorkspaceAgentScriptTimingStatus) Scan(value interface{}) error

+ func (ns NullWorkspaceAgentScriptTimingStatus) Value() (driver.Value, error)

type ProvisionerDaemon

+ KeyID uuid.UUID

+ type RemoveUserFromGroupsParams struct

+ GroupIds []uuid.UUID

+ UserID uuid.UUID

type UniqueConstraint

+ const UniqueCryptoKeysPkey

+ const UniqueNotificationReportGeneratorLogsPkey

+ const UniqueWorkspaceAgentScriptTimingsScriptIDStartedAtKey

+ const UniqueWorkspaceAgentScriptsIDKey

+ type UpdateCryptoKeyDeletesAtParams struct

+ DeletesAt sql.NullTime

+ Feature CryptoKeyFeature

+ Sequence int32

+ type UpsertNotificationReportGeneratorLogParams struct

+ LastGeneratedAt time.Time

+ NotificationTemplateID uuid.UUID

type UpsertProvisionerDaemonParams

+ KeyID uuid.UUID

+ type UpsertRuntimeConfigParams struct

+ Key string

+ Value string

type User

+ HashedOneTimePasscode []byte

+ MustResetPassword bool

+ OneTimePasscodeExpiresAt sql.NullTime

type WorkspaceAgentScript

+ DisplayName string

+ ID uuid.UUID

+ type WorkspaceAgentScriptTiming struct

+ EndedAt time.Time

+ ExitCode int32

+ ScriptID uuid.UUID

+ Stage WorkspaceAgentScriptTimingStage

+ StartedAt time.Time

+ Status WorkspaceAgentScriptTimingStatus

+ type WorkspaceAgentScriptTimingStage string

+ const WorkspaceAgentScriptTimingStageCron

+ const WorkspaceAgentScriptTimingStageStart

+ const WorkspaceAgentScriptTimingStageStop

+ func AllWorkspaceAgentScriptTimingStageValues() []WorkspaceAgentScriptTimingStage

+ func (e *WorkspaceAgentScriptTimingStage) Scan(src interface{}) error

+ func (e WorkspaceAgentScriptTimingStage) Valid() bool

+ type WorkspaceAgentScriptTimingStatus string

+ const WorkspaceAgentScriptTimingStatusExitFailure

+ const WorkspaceAgentScriptTimingStatusOk

+ const WorkspaceAgentScriptTimingStatusPipesLeftOpen

+ const WorkspaceAgentScriptTimingStatusTimedOut

+ func AllWorkspaceAgentScriptTimingStatusValues() []WorkspaceAgentScriptTimingStatus

+ func (e *WorkspaceAgentScriptTimingStatus) Scan(src interface{}) error

+ func (e WorkspaceAgentScriptTimingStatus) Valid() bool

type WorkspaceAgentStat

+ Usage bool

type WorkspaceApp

+ Hidden bool

Oct 28, 2024 GO-2025-3921 +18 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 8, 2024 GO-2025-3921 +18 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 8, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Oct 1, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 3, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AcquireNotificationMessagesRow

+ Disabled bool

+ type ConnectorCreator interface

+ Connector func(name string) (driver.Connector, error)

+ type DeleteCustomRoleParams struct

+ Name string

+ OrganizationID uuid.NullUUID

+ type DialerConnector interface

+ Dialer func(dialer pq.Dialer)

type EnqueueNotificationMessageParams

+ CreatedAt time.Time

type FetchNewMessageMetadataRow

+ CustomMethod NullNotificationMethod

type ForeignKeyConstraint

+ const ForeignKeyNotificationPreferencesNotificationTemplateID

+ const ForeignKeyNotificationPreferencesUserID

+ const ForeignKeyProvisionerJobTimingsJobID

+ type GetGroupsParams struct

+ HasMemberID uuid.UUID

+ OrganizationID uuid.UUID

+ type GetGroupsRow struct

+ Group Group

+ OrganizationDisplayName string

+ OrganizationName string

+ func (g GetGroupsRow) RBACObject() rbac.Object

+ type GetOrganizationsParams struct

+ IDs []uuid.UUID

+ Name string

+ type GetQuotaAllowanceForUserParams struct

+ OrganizationID uuid.UUID

+ UserID uuid.UUID

+ type GetQuotaConsumedForUserParams struct

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

type GetTemplatesWithFilterParams

+ FuzzyName string

type GetWorkspacesParams

+ OrganizationID uuid.UUID

type GroupMember

+ GroupName string

+ OrganizationID uuid.UUID

+ UserAvatarUrl string

+ UserCreatedAt time.Time

+ UserDeleted bool

+ UserEmail string

+ UserGithubComUserID sql.NullInt64

+ UserHashedPassword []byte

+ UserLastSeenAt time.Time

+ UserLoginType LoginType

+ UserName string

+ UserQuietHoursSchedule string

+ UserRbacRoles []string

+ UserStatus UserStatus

+ UserThemePreference string

+ UserUpdatedAt time.Time

+ UserUsername string

+ func (gm GroupMember) RBACObject() rbac.Object

+ type GroupMemberTable struct

+ GroupID uuid.UUID

+ UserID uuid.UUID

+ type InsertCustomRoleParams struct

+ DisplayName string

+ Name string

+ OrgPermissions CustomRolePermissions

+ OrganizationID uuid.NullUUID

+ SitePermissions CustomRolePermissions

+ UserPermissions CustomRolePermissions

+ type InsertProvisionerJobTimingsParams struct

+ Action []string

+ EndedAt []time.Time

+ JobID uuid.UUID

+ Resource []string

+ Source []string

+ Stage []ProvisionerJobTimingStage

+ StartedAt []time.Time

type NotificationMessage

+ DedupeHash sql.NullString

type NotificationMessageStatus

+ const NotificationMessageStatusInhibited

+ type NotificationPreference struct

+ CreatedAt time.Time

+ Disabled bool

+ NotificationTemplateID uuid.UUID

+ UpdatedAt time.Time

+ UserID uuid.UUID

type NotificationTemplate

+ Kind NotificationTemplateKind

+ Method NullNotificationMethod

+ type NotificationTemplateKind string

+ const NotificationTemplateKindSystem

+ func AllNotificationTemplateKindValues() []NotificationTemplateKind

+ func (e *NotificationTemplateKind) Scan(src interface{}) error

+ func (e NotificationTemplateKind) Valid() bool

+ type NullNotificationTemplateKind struct

+ NotificationTemplateKind NotificationTemplateKind

+ Valid bool

+ func (ns *NullNotificationTemplateKind) Scan(value interface{}) error

+ func (ns NullNotificationTemplateKind) Value() (driver.Value, error)

+ type NullProvisionerJobTimingStage struct

+ ProvisionerJobTimingStage ProvisionerJobTimingStage

+ Valid bool

+ func (ns *NullProvisionerJobTimingStage) Scan(value interface{}) error

+ func (ns NullProvisionerJobTimingStage) Value() (driver.Value, error)

+ type ProvisionerJobStat struct

+ ApplySecs float64

+ CanceledSecs float64

+ CompletionSecs float64

+ Error sql.NullString

+ ErrorCode sql.NullString

+ GraphSecs float64

+ InitSecs float64

+ JobID uuid.UUID

+ JobStatus ProvisionerJobStatus

+ PlanSecs float64

+ QueuedSecs float64

+ UpdatedAt time.Time

+ WorkerID uuid.NullUUID

+ WorkspaceID uuid.UUID

+ type ProvisionerJobTiming struct

+ Action string

+ EndedAt time.Time

+ JobID uuid.UUID

+ Resource string

+ Source string

+ Stage ProvisionerJobTimingStage

+ StartedAt time.Time

+ type ProvisionerJobTimingStage string

+ const ProvisionerJobTimingStageApply

+ const ProvisionerJobTimingStageGraph

+ const ProvisionerJobTimingStageInit

+ const ProvisionerJobTimingStagePlan

+ func AllProvisionerJobTimingStageValues() []ProvisionerJobTimingStage

+ func (e *ProvisionerJobTimingStage) Scan(src interface{}) error

+ func (e ProvisionerJobTimingStage) Valid() bool

type ResourceType

+ const ResourceTypeNotificationTemplate

type UniqueConstraint

+ const UniqueCustomRolesUniqueKey

+ const UniqueIndexProvisionerDaemonsOrgNameOwnerKey

+ const UniqueNotificationMessagesDedupeHashIndex

+ const UniqueNotificationPreferencesPkey

+ type UpdateCustomRoleParams struct

+ DisplayName string

+ Name string

+ OrgPermissions CustomRolePermissions

+ OrganizationID uuid.NullUUID

+ SitePermissions CustomRolePermissions

+ UserPermissions CustomRolePermissions

+ type UpdateNotificationTemplateMethodByIDParams struct

+ ID uuid.UUID

+ Method NullNotificationMethod

+ type UpdateTailnetPeerStatusByCoordinatorParams struct

+ CoordinatorID uuid.UUID

+ Status TailnetStatus

+ type UpdateUserNotificationPreferencesParams struct

+ Disableds []bool

+ NotificationTemplateIds []uuid.UUID

+ UserID uuid.UUID

Oct 24, 2024 GO-2025-3921 +18 more

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Sep 5, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 20, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 7, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 6, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type AcquireNotificationMessagesRow

+ AttemptCount int32

+ QueuedSeconds float64

+ TemplateID uuid.UUID

type AuditLog

+ func (w AuditLog) RBACObject() rbac.Object

type FetchNewMessageMetadataRow

+ UserUsername string

type ForeignKeyConstraint

+ const ForeignKeyProvisionerKeysOrganizationID

type GetAuditLogsOffsetRow

+ AuditLog AuditLog

+ OrganizationDisplayName string

+ OrganizationIcon string

+ OrganizationName string

+ func (w GetAuditLogsOffsetRow) RBACObject() rbac.Object

+ type GetNotificationMessagesByStatusParams struct

+ Limit int32

+ Status NotificationMessageStatus

+ type GetProvisionerKeyByNameParams struct

+ Name string

+ OrganizationID uuid.UUID

type GetUsersRow

+ GithubComUserID sql.NullInt64

+ type InsertProvisionerKeyParams struct

+ CreatedAt time.Time

+ HashedSecret []byte

+ ID uuid.UUID

+ Name string

+ OrganizationID uuid.UUID

+ Tags StringMap

type NotificationMessage

+ QueuedSeconds sql.NullFloat64

+ type NotificationsSettings struct

+ ID uuid.UUID

+ NotifierPaused bool

type OrganizationMembersRow

+ AvatarURL string

+ Email string

+ GlobalRoles pq.StringArray

+ Name string

+ type ProvisionerKey struct

+ CreatedAt time.Time

+ HashedSecret []byte

+ ID uuid.UUID

+ Name string

+ OrganizationID uuid.UUID

+ Tags StringMap

+ func (p ProvisionerKey) RBACObject() rbac.Object

type ResourceType

+ const ResourceTypeNotificationsSettings

type Template

+ OrganizationDisplayName string

+ OrganizationIcon string

+ OrganizationName string

type UniqueConstraint

+ const UniqueProvisionerKeysOrganizationIDNameIndex

+ const UniqueProvisionerKeysPkey

+ type UpdateUserGithubComUserIDParams struct

+ GithubComUserID sql.NullInt64

+ ID uuid.UUID

type User

+ GithubComUserID sql.NullInt64

Aug 20, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 6, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 1, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 23, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 18, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 2, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ func ExpectOne[T any](ret []T, err error) (T, error)

+ type AcquireNotificationMessagesParams struct

+ Count int32

+ LeaseSeconds int32

+ MaxAttemptCount int32

+ NotifierID uuid.UUID

+ type AcquireNotificationMessagesRow struct

+ BodyTemplate string

+ CreatedBy string

+ ID uuid.UUID

+ Method NotificationMethod

+ Payload json.RawMessage

+ TitleTemplate string

+ type AuditableOrganizationMember struct

+ Username string

+ type BulkMarkNotificationMessagesFailedParams struct

+ FailedAts []time.Time

+ IDs []uuid.UUID

+ MaxAttempts int32

+ RetryInterval int32

+ StatusReasons []string

+ Statuses []NotificationMessageStatus

+ type BulkMarkNotificationMessagesSentParams struct

+ IDs []uuid.UUID

+ SentAts []time.Time

type CustomRole

+ ID uuid.UUID

+ func (r CustomRole) RoleIdentifier() rbac.RoleIdentifier

+ type CustomRolePermission struct

+ Action policy.Action

+ Negate bool

+ ResourceType string

+ func (a CustomRolePermission) String() string

+ type CustomRolePermissions []CustomRolePermission

+ func (a *CustomRolePermissions) Scan(src interface{}) error

+ func (a CustomRolePermissions) Value() (driver.Value, error)

+ type DeleteOrganizationMemberParams struct

+ OrganizationID uuid.UUID

+ UserID uuid.UUID

+ type EnqueueNotificationMessageParams struct

+ CreatedBy string

+ ID uuid.UUID

+ Method NotificationMethod

+ NotificationTemplateID uuid.UUID

+ Payload json.RawMessage

+ Targets []uuid.UUID

+ UserID uuid.UUID

+ type FetchNewMessageMetadataParams struct

+ NotificationTemplateID uuid.UUID

+ UserID uuid.UUID

+ type FetchNewMessageMetadataRow struct

+ Actions []byte

+ NotificationName string

+ UserEmail string

+ UserID uuid.UUID

+ UserName string

type ForeignKeyConstraint

+ const ForeignKeyNotificationMessagesNotificationTemplateID

+ const ForeignKeyNotificationMessagesUserID

type GetAuditLogsOffsetParams

+ LimitOpt int32

+ OffsetOpt int32

+ OrganizationID uuid.UUID

type GetAuditLogsOffsetRow

+ UserDeleted sql.NullBool

+ UserLastSeenAt sql.NullTime

+ UserLoginType NullLoginType

+ UserName sql.NullString

+ UserQuietHoursSchedule sql.NullString

+ UserThemePreference sql.NullString

+ UserUpdatedAt sql.NullTime

type GetAuthorizationUserRolesRow

+ func (r GetAuthorizationUserRolesRow) RoleNames() ([]rbac.RoleIdentifier, error)

type InsertOrganizationParams

+ DisplayName string

+ Icon string

type InsertUserParams

+ Name string

+ type NameOrganizationPair struct

+ Name string

+ OrganizationID uuid.UUID

+ func (*NameOrganizationPair) Scan(_ interface{}) error

+ func (a NameOrganizationPair) Value() (driver.Value, error)

+ type NotificationMessage struct

+ AttemptCount sql.NullInt32

+ CreatedAt time.Time

+ CreatedBy string

+ ID uuid.UUID

+ LeasedUntil sql.NullTime

+ Method NotificationMethod

+ NextRetryAfter sql.NullTime

+ NotificationTemplateID uuid.UUID

+ Payload []byte

+ Status NotificationMessageStatus

+ StatusReason sql.NullString

+ Targets []uuid.UUID

+ UpdatedAt sql.NullTime

+ UserID uuid.UUID

+ type NotificationMessageStatus string

+ const NotificationMessageStatusLeased

+ const NotificationMessageStatusPending

+ const NotificationMessageStatusPermanentFailure

+ const NotificationMessageStatusSent

+ const NotificationMessageStatusTemporaryFailure

+ const NotificationMessageStatusUnknown

+ func AllNotificationMessageStatusValues() []NotificationMessageStatus

+ func (e *NotificationMessageStatus) Scan(src interface{}) error

+ func (e NotificationMessageStatus) Valid() bool

+ type NotificationMethod string

+ const NotificationMethodSmtp

+ const NotificationMethodWebhook

+ func AllNotificationMethodValues() []NotificationMethod

+ func (e *NotificationMethod) Scan(src interface{}) error

+ func (e NotificationMethod) Valid() bool

+ type NotificationTemplate struct

+ Actions []byte

+ BodyTemplate string

+ Group sql.NullString

+ ID uuid.UUID

+ Name string

+ TitleTemplate string

+ type NullNotificationMessageStatus struct

+ NotificationMessageStatus NotificationMessageStatus

+ Valid bool

+ func (ns *NullNotificationMessageStatus) Scan(value interface{}) error

+ func (ns NullNotificationMessageStatus) Value() (driver.Value, error)

+ type NullNotificationMethod struct

+ NotificationMethod NotificationMethod

+ Valid bool

+ func (ns *NullNotificationMethod) Scan(value interface{}) error

+ func (ns NullNotificationMethod) Value() (driver.Value, error)

type Organization

+ DisplayName string

+ Icon string

type OrganizationMember

+ func (m OrganizationMember) Auditable(username string) AuditableOrganizationMember

+ type OrganizationMembersParams struct

+ OrganizationID uuid.UUID

+ UserID uuid.UUID

+ type OrganizationMembersRow struct

+ OrganizationMember OrganizationMember

+ Username string

+ func (m OrganizationMembersRow) RBACObject() rbac.Object

type ResourceType

+ const ResourceTypeCustomRole

+ const ResourceTypeOrganizationMember

type UniqueConstraint

+ const UniqueNotificationMessagesPkey

+ const UniqueNotificationTemplatesNameKey

+ const UniqueNotificationTemplatesPkey

type UpdateOrganizationParams

+ Description string

+ DisplayName string

+ Icon string

Aug 1, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jul 18, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 24, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 21, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 6, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 4, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type CustomRole struct

+ CreatedAt time.Time

+ DisplayName string

+ Name string

+ OrgPermissions json.RawMessage

+ OrganizationID uuid.NullUUID

+ SitePermissions json.RawMessage

+ UpdatedAt time.Time

+ UserPermissions json.RawMessage

+ type CustomRolesParams struct

+ ExcludeOrgRoles bool

+ LookupRoles []string

+ OrganizationID uuid.UUID

type ForeignKeyConstraint

+ const ForeignKeyTemplateVersionWorkspaceTagsTemplateVersionID

type GetTemplateAppInsightsRow

+ TimesUsed int64

+ type InsertTemplateVersionWorkspaceTagParams struct

+ Key string

+ TemplateVersionID uuid.UUID

+ Value string

+ type TemplateVersionWorkspaceTag struct

+ Key string

+ TemplateVersionID uuid.UUID

+ Value string

type UniqueConstraint

+ const UniqueCustomRolesPkey

+ const UniqueIndexCustomRolesNameLower

+ const UniqueOrganizationsName

+ const UniqueTemplateVersionWorkspaceTagsTemplateVersionIDKeyKey

+ type UpdateOrganizationParams struct

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

+ type UpsertCustomRoleParams struct

+ DisplayName string

+ Name string

+ OrgPermissions json.RawMessage

+ OrganizationID uuid.NullUUID

+ SitePermissions json.RawMessage

+ UserPermissions json.RawMessage

Jun 24, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jun 21, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 16, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

May 6, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LockIDDBPurge

+ type GetGroupsByOrganizationAndUserIDParams struct

+ OrganizationID uuid.UUID

+ UserID uuid.UUID

May 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 17, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 3, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LockIDDBRollup

type AcquireProvisionerJobParams

+ OrganizationID uuid.UUID

type GetTemplateAppInsightsRow

+ ActiveUsers int64

+ Slug string

type GetTemplateInsightsRow

+ ActiveUsers int64

+ JetbrainsTemplateIds []uuid.UUID

+ ReconnectingPtyTemplateIds []uuid.UUID

+ SftpTemplateIds []uuid.UUID

+ SshTemplateIds []uuid.UUID

+ UsageSftpSeconds int64

+ UsageTotalSeconds int64

+ VscodeTemplateIds []uuid.UUID

+ type GetTemplateUsageStatsParams struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetWorkspaceAgentAndLatestBuildByAuthTokenRow struct

+ Workspace Workspace

+ WorkspaceAgent WorkspaceAgent

+ WorkspaceBuild WorkspaceBuild

type GetWorkspacesParams

+ HasParam []string

+ ParamNames []string

+ ParamValues []string

type GetWorkspacesRow

+ LatestBuildStatus ProvisionerJobStatus

+ type StringMapOfInt map[string]int64

+ func (m *StringMapOfInt) Scan(src interface{}) error

+ func (m StringMapOfInt) Value() (driver.Value, error)

+ type TemplateUsageStat struct

+ AppUsageMins StringMapOfInt

+ EndTime time.Time

+ JetbrainsMins int16

+ MedianLatencyMs sql.NullFloat64

+ ReconnectingPtyMins int16

+ SftpMins int16

+ SshMins int16

+ StartTime time.Time

+ TemplateID uuid.UUID

+ UsageMins int16

+ UserID uuid.UUID

+ VscodeMins int16

type UniqueConstraint

+ const UniqueTemplateUsageStatsPkey

+ const UniqueTemplateUsageStatsStartTimeTemplateIDUserIDIndex

+ const UniqueUserLinksLinkedIDLoginTypeIndex

Apr 22, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 17, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Apr 5, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 19, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 12, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const LockIDEnterpriseDeploymentSetup

+ type DeleteOAuth2ProviderAppCodesByAppAndUserIDParams struct

+ AppID uuid.UUID

+ UserID uuid.UUID

+ type DeleteOAuth2ProviderAppTokensByAppAndUserIDParams struct

+ AppID uuid.UUID

+ UserID uuid.UUID

+ type DeleteWorkspaceAgentPortShareParams struct

+ AgentName string

+ Port int32

+ WorkspaceID uuid.UUID

+ type ExternalAuthProvider struct

+ ID string

+ Optional bool

type ForeignKeyConstraint

+ const ForeignKeyOauth2ProviderAppCodesAppID

+ const ForeignKeyOauth2ProviderAppCodesUserID

+ const ForeignKeyOauth2ProviderAppTokensAPIKeyID

+ const ForeignKeyOauth2ProviderAppTokensAppSecretID

+ const ForeignKeyProvisionerDaemonsOrganizationID

+ const ForeignKeyWorkspaceAgentPortShareWorkspaceID

+ type GetOAuth2ProviderAppsByUserIDRow struct

+ OAuth2ProviderApp OAuth2ProviderApp

+ TokenCount int64

+ func (a GetOAuth2ProviderAppsByUserIDRow) RBACObject() rbac.Object

+ type GetWorkspaceAgentPortShareParams struct

+ AgentName string

+ Port int32

+ WorkspaceID uuid.UUID

type GetWorkspacesParams

+ WithSummary bool

+ WorkspaceIds []uuid.UUID

type GetWorkspacesRow

+ LatestBuildCanceledAt sql.NullTime

+ LatestBuildCompletedAt sql.NullTime

+ LatestBuildError sql.NullString

+ LatestBuildTransition WorkspaceTransition

+ Username string

+ type InsertOAuth2ProviderAppCodeParams struct

+ AppID uuid.UUID

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ HashedSecret []byte

+ ID uuid.UUID

+ SecretPrefix []byte

+ UserID uuid.UUID

type InsertOAuth2ProviderAppSecretParams

+ SecretPrefix []byte

+ type InsertOAuth2ProviderAppTokenParams struct

+ APIKeyID string

+ AppSecretID uuid.UUID

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ HashPrefix []byte

+ ID uuid.UUID

+ RefreshHash []byte

type InsertTemplateParams

+ MaxPortSharingLevel AppSharingLevel

type InsertWorkspaceAgentMetadataParams

+ DisplayOrder int32

type InsertWorkspaceAgentParams

+ DisplayOrder int32

type InsertWorkspaceAppParams

+ DisplayOrder int32

type LoginType

+ const LoginTypeOAuth2ProviderApp

+ type NullPortShareProtocol struct

+ PortShareProtocol PortShareProtocol

+ Valid bool

+ func (ns *NullPortShareProtocol) Scan(value interface{}) error

+ func (ns NullPortShareProtocol) Value() (driver.Value, error)

type OAuth2ProviderApp

+ func (OAuth2ProviderApp) RBACObject() rbac.Object

+ type OAuth2ProviderAppCode struct

+ AppID uuid.UUID

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ HashedSecret []byte

+ ID uuid.UUID

+ SecretPrefix []byte

+ UserID uuid.UUID

+ func (c OAuth2ProviderAppCode) RBACObject() rbac.Object

type OAuth2ProviderAppSecret

+ SecretPrefix []byte

+ func (OAuth2ProviderAppSecret) RBACObject() rbac.Object

+ type OAuth2ProviderAppToken struct

+ APIKeyID string

+ AppSecretID uuid.UUID

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ HashPrefix []byte

+ ID uuid.UUID

+ RefreshHash []byte

type Organization

+ IsDefault bool

+ type PortShareProtocol string

+ const PortShareProtocolHttp

+ const PortShareProtocolHttps

+ func AllPortShareProtocolValues() []PortShareProtocol

+ func (e *PortShareProtocol) Scan(src interface{}) error

+ func (e PortShareProtocol) Valid() bool

type ProvisionerDaemon

+ OrganizationID uuid.UUID

type ResourceType

+ const ResourceTypeOauth2ProviderApp

+ const ResourceTypeOauth2ProviderAppSecret

type Template

+ ActivityBump int64

+ MaxPortSharingLevel AppSharingLevel

type TemplateTable

+ ActivityBump int64

+ MaxPortSharingLevel AppSharingLevel

type UniqueConstraint

+ const UniqueOauth2ProviderAppCodesPkey

+ const UniqueOauth2ProviderAppCodesSecretPrefixKey

+ const UniqueOauth2ProviderAppSecretsSecretPrefixKey

+ const UniqueOauth2ProviderAppTokensHashPrefixKey

+ const UniqueOauth2ProviderAppTokensPkey

+ const UniqueOrganizationsSingleDefaultOrg

+ const UniqueWorkspaceAgentPortSharePkey

type UpdateTemplateMetaByIDParams

+ MaxPortSharingLevel AppSharingLevel

type UpdateTemplateScheduleByIDParams

+ ActivityBump int64

type UpsertProvisionerDaemonParams

+ OrganizationID uuid.UUID

+ type UpsertWorkspaceAgentPortShareParams struct

+ AgentName string

+ Port int32

+ Protocol PortShareProtocol

+ ShareLevel AppSharingLevel

+ WorkspaceID uuid.UUID

type WorkspaceAgent

+ DisplayOrder int32

type WorkspaceAgentMetadatum

+ DisplayOrder int32

+ type WorkspaceAgentPortShare struct

+ AgentName string

+ Port int32

+ Protocol PortShareProtocol

+ ShareLevel AppSharingLevel

+ WorkspaceID uuid.UUID

type WorkspaceApp

+ DisplayOrder int32

Mar 9, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Mar 4, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 15, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 12, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 7, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Feb 7, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type ExternalAuthLink

+ func (u ExternalAuthLink) OAuthToken() *oauth2.Token

type ForeignKeyConstraint

+ const ForeignKeyJfrogXrayScansAgentID

+ const ForeignKeyJfrogXrayScansWorkspaceID

+ type GetJFrogXrayScanByWorkspaceAndAgentIDParams struct

+ AgentID uuid.UUID

+ WorkspaceID uuid.UUID

+ type GetUserWorkspaceBuildParametersParams struct

+ OwnerID uuid.UUID

+ TemplateID uuid.UUID

+ type GetUserWorkspaceBuildParametersRow struct

+ Name string

+ Value string

type GetWorkspacesParams

+ RequesterID uuid.UUID

+ UsingActive sql.NullBool

type GetWorkspacesRow

+ Favorite bool

+ type JfrogXrayScan struct

+ AgentID uuid.UUID

+ Critical int32

+ High int32

+ Medium int32

+ ResultsUrl string

+ WorkspaceID uuid.UUID

type UniqueConstraint

+ const UniqueJfrogXrayScansPkey

+ type UpsertJFrogXrayScanByWorkspaceAndAgentIDParams struct

+ AgentID uuid.UUID

+ Critical int32

+ High int32

+ Medium int32

+ ResultsUrl string

+ WorkspaceID uuid.UUID

type User

+ func (u User) UserWorkspaceBuildParametersObject() rbac.Object

type Workspace

+ Favorite bool

Mar 4, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 24, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 22, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Jan 19, 2024 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type BatchUpdateWorkspaceLastUsedAtParams struct

+ IDs []uuid.UUID

+ LastUsedAt time.Time

type GetUsersRow

+ Name string

type UpdateTemplateMetaByIDParams

+ GroupACL TemplateACL

type UpdateUserProfileParams

+ Name string

type User

+ Name string

Mar 4, 2024 GO-2024-3228 +19 more

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Dec 21, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type ForeignKeyConstraint

+ const ForeignKeyOauth2ProviderAppSecretsAppID

type GetWorkspaceAgentAndOwnerByAuthTokenRow

+ TemplateID uuid.UUID

+ TemplateVersionID uuid.UUID

+ type InsertOAuth2ProviderAppParams struct

+ CallbackURL string

+ CreatedAt time.Time

+ ID uuid.UUID

+ Icon string

+ Name string

+ UpdatedAt time.Time

+ type InsertOAuth2ProviderAppSecretParams struct

+ AppID uuid.UUID

+ CreatedAt time.Time

+ DisplaySecret string

+ HashedSecret []byte

+ ID uuid.UUID

+ type OAuth2ProviderApp struct

+ CallbackURL string

+ CreatedAt time.Time

+ ID uuid.UUID

+ Icon string

+ Name string

+ UpdatedAt time.Time

+ type OAuth2ProviderAppSecret struct

+ AppID uuid.UUID

+ CreatedAt time.Time

+ DisplaySecret string

+ HashedSecret []byte

+ ID uuid.UUID

+ LastUsedAt sql.NullTime

type Template

+ UseMaxTtl bool

type TemplateTable

+ UseMaxTtl bool

type UniqueConstraint

+ const UniqueOauth2ProviderAppSecretsAppIDHashedSecretKey

+ const UniqueOauth2ProviderAppSecretsPkey

+ const UniqueOauth2ProviderAppsNameKey

+ const UniqueOauth2ProviderAppsPkey

+ type UpdateOAuth2ProviderAppByIDParams struct

+ CallbackURL string

+ ID uuid.UUID

+ Icon string

+ Name string

+ UpdatedAt time.Time

+ type UpdateOAuth2ProviderAppSecretByIDParams struct

+ ID uuid.UUID

+ LastUsedAt sql.NullTime

+ type UpdateProvisionerDaemonLastSeenAtParams struct

+ ID uuid.UUID

+ LastSeenAt sql.NullTime

type UpdateTemplateScheduleByIDParams

+ UseMaxTtl bool

Dec 14, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type GetWorkspaceByAgentIDRow struct

+ TemplateName string

+ Workspace Workspace

+ func (w GetWorkspaceByAgentIDRow) RBACObject() rbac.Object

type ProvisionerDaemon

+ APIVersion string

type UniqueConstraint

+ const UniqueIndexProvisionerDaemonsNameOwnerKey

+ type UpdateUserAppearanceSettingsParams struct

+ ID uuid.UUID

+ ThemePreference string

+ UpdatedAt time.Time

+ type UpsertProvisionerDaemonParams struct

+ APIVersion string

+ CreatedAt time.Time

+ LastSeenAt sql.NullTime

+ Name string

+ Provisioners []ProvisionerType

+ Tags StringMap

+ Version string

Dec 12, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type BuildReason

+ const BuildReasonDormancy

+ type DeleteExternalAuthLinkParams struct

+ ProviderID string

+ UserID uuid.UUID

type GetTailnetTunnelPeerBindingsRow

+ Status TailnetStatus

type GetTemplatesWithFilterParams

+ Deprecated sql.NullBool

type GetUsersRow

+ ThemePreference string

+ type GetWorkspaceUniqueOwnerCountByTemplateIDsRow struct

+ TemplateID uuid.UUID

+ UniqueOwnersSum int64

type GetWorkspacesParams

+ Dormant bool

+ type HealthSettings struct

+ DismissedHealthchecks []codersdk.HealthSection

+ ID uuid.UUID

type InsertProvisionerDaemonParams

+ LastSeenAt sql.NullTime

type InsertUserLinkParams

+ DebugContext json.RawMessage

type ProvisionerDaemon

+ LastSeenAt sql.NullTime

+ Version string

type RegisterWorkspaceProxyParams

+ Version string

type ResourceType

+ const ResourceTypeHealthSettings

type Template

+ Deprecated string

type TemplateTable

+ Deprecated string

type UpdateTemplateAccessControlByIDParams

+ Deprecated string

type UpdateUserLinkParams

+ DebugContext json.RawMessage

type User

+ ThemePreference string

type UserLink

+ DebugContext json.RawMessage

type WorkspaceProxy

+ Version string

Nov 17, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type ActivityBumpWorkspaceParams struct

+ NextAutostart time.Time

+ WorkspaceID uuid.UUID

+ type DeleteAllTailnetTunnelsParams struct

+ CoordinatorID uuid.UUID

+ SrcID uuid.UUID

+ type DeleteTailnetPeerParams struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ type DeleteTailnetPeerRow struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ type DeleteTailnetTunnelParams struct

+ CoordinatorID uuid.UUID

+ DstID uuid.UUID

+ SrcID uuid.UUID

+ type DeleteTailnetTunnelRow struct

+ CoordinatorID uuid.UUID

+ DstID uuid.UUID

+ SrcID uuid.UUID

type ForeignKeyConstraint

+ const ForeignKeyTailnetPeersCoordinatorID

+ const ForeignKeyTailnetTunnelsCoordinatorID

+ type GetTailnetTunnelPeerBindingsRow struct

+ CoordinatorID uuid.UUID

+ Node []byte

+ PeerID uuid.UUID

+ UpdatedAt time.Time

+ type GetTailnetTunnelPeerIDsRow struct

+ CoordinatorID uuid.UUID

+ PeerID uuid.UUID

+ UpdatedAt time.Time

+ type GetTemplateAppInsightsByTemplateParams struct

+ EndTime time.Time

+ StartTime time.Time

+ type GetTemplateAppInsightsByTemplateRow struct

+ ActiveUsers int64

+ DisplayName sql.NullString

+ SlugOrPort string

+ TemplateID uuid.UUID

+ UsageSeconds int64

+ type NullTailnetStatus struct

+ TailnetStatus TailnetStatus

+ Valid bool

+ func (ns *NullTailnetStatus) Scan(value interface{}) error

+ func (ns NullTailnetStatus) Value() (driver.Value, error)

+ type TailnetPeer struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ Node []byte

+ Status TailnetStatus

+ UpdatedAt time.Time

+ type TailnetStatus string

+ const TailnetStatusLost

+ const TailnetStatusOk

+ func AllTailnetStatusValues() []TailnetStatus

+ func (e *TailnetStatus) Scan(src interface{}) error

+ func (e TailnetStatus) Valid() bool

+ type TailnetTunnel struct

+ CoordinatorID uuid.UUID

+ DstID uuid.UUID

+ SrcID uuid.UUID

+ UpdatedAt time.Time

type UniqueConstraint

+ const UniqueTailnetPeersPkey

+ const UniqueTailnetTunnelsPkey

type UpdateWorkspaceAgentStartupByIDParams

+ APIVersion string

+ type UpsertTailnetPeerParams struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ Node []byte

+ Status TailnetStatus

+ type UpsertTailnetTunnelParams struct

+ CoordinatorID uuid.UUID

+ DstID uuid.UUID

+ SrcID uuid.UUID

Oct 30, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type WorkspaceAgent

+ APIVersion string

Oct 20, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type GetTemplateInsightsByTemplateParams struct

+ EndTime time.Time

+ StartTime time.Time

+ type GetTemplateInsightsByTemplateRow struct

+ ActiveUsers int64

+ TemplateID uuid.UUID

+ UsageJetbrainsSeconds int64

+ UsageReconnectingPtySeconds int64

+ UsageSshSeconds int64

+ UsageVscodeSeconds int64

type Template

+ RequireActiveVersion bool

type TemplateTable

+ RequireActiveVersion bool

+ type UpdateTemplateAccessControlByIDParams struct

+ ID uuid.UUID

+ RequireActiveVersion bool

Oct 17, 2023 GO-2024-2602 +20 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type GetWorkspaceAgentMetadataParams struct

+ Keys []string

+ WorkspaceAgentID uuid.UUID

type Template

+ AutostartBlockDaysOfWeek int16

+ func (t Template) AutostartAllowedDays() uint8

type TemplateTable

+ AutostartBlockDaysOfWeek int16

type UpdateTemplateScheduleByIDParams

+ AutostartBlockDaysOfWeek int16

Oct 11, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type ArchiveUnusedTemplateVersionsParams struct

+ JobStatus NullProvisionerJobStatus

+ TemplateID uuid.UUID

+ TemplateVersionID uuid.UUID

+ UpdatedAt time.Time

+ type AutomaticUpdates string

+ const AutomaticUpdatesAlways

+ const AutomaticUpdatesNever

+ func AllAutomaticUpdatesValues() []AutomaticUpdates

+ func (e *AutomaticUpdates) Scan(src interface{}) error

+ func (e AutomaticUpdates) Valid() bool

type ExternalAuthLink

+ OAuthExtra pqtype.NullRawMessage

type GetTemplateVersionsByTemplateIDParams

+ Archived sql.NullBool

type GetWorkspacesParams

+ IsDormant string

type GetWorkspacesRow

+ AutomaticUpdates AutomaticUpdates

type InsertExternalAuthLinkParams

+ OAuthExtra pqtype.NullRawMessage

type InsertWorkspaceParams

+ AutomaticUpdates AutomaticUpdates

+ type NullAutomaticUpdates struct

+ AutomaticUpdates AutomaticUpdates

+ Valid bool

+ func (ns *NullAutomaticUpdates) Scan(value interface{}) error

+ func (ns NullAutomaticUpdates) Value() (driver.Value, error)

+ type NullProvisionerJobStatus struct

+ ProvisionerJobStatus ProvisionerJobStatus

+ Valid bool

+ func (ns *NullProvisionerJobStatus) Scan(value interface{}) error

+ func (ns NullProvisionerJobStatus) Value() (driver.Value, error)

type ProvisionerJob

+ JobStatus ProvisionerJobStatus

+ func (p ProvisionerJob) Finished() bool

+ func (p ProvisionerJob) FinishedAt() time.Time

+ type ProvisionerJobStatus string

+ const ProvisionerJobStatusCanceled

+ const ProvisionerJobStatusCanceling

+ const ProvisionerJobStatusFailed

+ const ProvisionerJobStatusPending

+ const ProvisionerJobStatusRunning

+ const ProvisionerJobStatusSucceeded

+ const ProvisionerJobStatusUnknown

+ func AllProvisionerJobStatusValues() []ProvisionerJobStatus

+ func (e *ProvisionerJobStatus) Scan(src interface{}) error

+ func (e ProvisionerJobStatus) Valid() bool

type TemplateVersion

+ Archived bool

type TemplateVersionTable

+ Archived bool

+ type UnarchiveTemplateVersionParams struct

+ TemplateVersionID uuid.UUID

+ UpdatedAt time.Time

type UpdateExternalAuthLinkParams

+ OAuthExtra pqtype.NullRawMessage

+ type UpdateWorkspaceAutomaticUpdatesParams struct

+ AutomaticUpdates AutomaticUpdates

+ ID uuid.UUID

type Workspace

+ AutomaticUpdates AutomaticUpdates

Oct 4, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type ExternalAuthLink struct

+ CreatedAt time.Time

+ OAuthAccessToken string

+ OAuthAccessTokenKeyID sql.NullString

+ OAuthExpiry time.Time

+ OAuthRefreshToken string

+ OAuthRefreshTokenKeyID sql.NullString

+ ProviderID string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ func (u ExternalAuthLink) RBACObject() rbac.Object

+ type GetExternalAuthLinkParams struct

+ ProviderID string

+ UserID uuid.UUID

+ type InsertExternalAuthLinkParams struct

+ CreatedAt time.Time

+ OAuthAccessToken string

+ OAuthAccessTokenKeyID sql.NullString

+ OAuthExpiry time.Time

+ OAuthRefreshToken string

+ OAuthRefreshTokenKeyID sql.NullString

+ ProviderID string

+ UpdatedAt time.Time

+ UserID uuid.UUID

type TemplateVersion

+ ExternalAuthProviders []string

type TemplateVersionTable

+ ExternalAuthProviders []string

+ type UpdateExternalAuthLinkParams struct

+ OAuthAccessToken string

+ OAuthAccessTokenKeyID sql.NullString

+ OAuthExpiry time.Time

+ OAuthRefreshToken string

+ OAuthRefreshTokenKeyID sql.NullString

+ ProviderID string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type UpdateTemplateVersionExternalAuthProvidersByJobIDParams struct

+ ExternalAuthProviders []string

+ JobID uuid.UUID

+ UpdatedAt time.Time

Sep 27, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ func IsForeignKeyViolation(err error, foreignKeyConstraints ...ForeignKeyConstraint) bool

+ type DBCryptKey struct

+ ActiveKeyDigest sql.NullString

+ CreatedAt sql.NullTime

+ Number int32

+ RevokedAt sql.NullTime

+ RevokedKeyDigest sql.NullString

+ Test string

+ type DeleteAllTailnetClientSubscriptionsParams struct

+ ClientID uuid.UUID

+ CoordinatorID uuid.UUID

+ type DeleteTailnetClientSubscriptionParams struct

+ AgentID uuid.UUID

+ ClientID uuid.UUID

+ CoordinatorID uuid.UUID

+ type ForeignKeyConstraint string

+ const ForeignKeyAPIKeysUserIDUUID

+ const ForeignKeyGitAuthLinksOauthAccessTokenKeyID

+ const ForeignKeyGitAuthLinksOauthRefreshTokenKeyID

+ const ForeignKeyGitSSHKeysUserID

+ const ForeignKeyGroupMembersGroupID

+ const ForeignKeyGroupMembersUserID

+ const ForeignKeyGroupsOrganizationID

+ const ForeignKeyOrganizationMembersOrganizationIDUUID

+ const ForeignKeyOrganizationMembersUserIDUUID

+ const ForeignKeyParameterSchemasJobID

+ const ForeignKeyProvisionerJobLogsJobID

+ const ForeignKeyProvisionerJobsOrganizationID

+ const ForeignKeyTailnetAgentsCoordinatorID

+ const ForeignKeyTailnetClientSubscriptionsCoordinatorID

+ const ForeignKeyTailnetClientsCoordinatorID

+ const ForeignKeyTemplateVersionParametersTemplateVersionID

+ const ForeignKeyTemplateVersionVariablesTemplateVersionID

+ const ForeignKeyTemplateVersionsCreatedBy

+ const ForeignKeyTemplateVersionsOrganizationID

+ const ForeignKeyTemplateVersionsTemplateID

+ const ForeignKeyTemplatesCreatedBy

+ const ForeignKeyTemplatesOrganizationID

+ const ForeignKeyUserLinksOauthAccessTokenKeyID

+ const ForeignKeyUserLinksOauthRefreshTokenKeyID

+ const ForeignKeyUserLinksUserID

+ const ForeignKeyWorkspaceAgentLogSourcesWorkspaceAgentID

+ const ForeignKeyWorkspaceAgentMetadataWorkspaceAgentID

+ const ForeignKeyWorkspaceAgentScriptsWorkspaceAgentID

+ const ForeignKeyWorkspaceAgentStartupLogsAgentID

+ const ForeignKeyWorkspaceAgentsResourceID

+ const ForeignKeyWorkspaceAppStatsAgentID

+ const ForeignKeyWorkspaceAppStatsUserID

+ const ForeignKeyWorkspaceAppStatsWorkspaceID

+ const ForeignKeyWorkspaceAppsAgentID

+ const ForeignKeyWorkspaceBuildParametersWorkspaceBuildID

+ const ForeignKeyWorkspaceBuildsJobID

+ const ForeignKeyWorkspaceBuildsTemplateVersionID

+ const ForeignKeyWorkspaceBuildsWorkspaceID

+ const ForeignKeyWorkspaceResourceMetadataWorkspaceResourceID

+ const ForeignKeyWorkspaceResourcesJobID

+ const ForeignKeyWorkspacesOrganizationID

+ const ForeignKeyWorkspacesOwnerID

+ const ForeignKeyWorkspacesTemplateID

+ type GetAllTailnetClientsRow struct

+ AgentIds []uuid.UUID

+ TailnetClient TailnetClient

+ type GetTemplateInsightsByIntervalParams struct

+ EndTime time.Time

+ IntervalDays int32

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetTemplateInsightsByIntervalRow struct

+ ActiveUsers int64

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetUserActivityInsightsParams struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetUserActivityInsightsRow struct

+ AvatarURL sql.NullString

+ TemplateIDs []uuid.UUID

+ UsageSeconds int64

+ UserID uuid.UUID

+ Username string

type GitAuthLink

+ OAuthAccessTokenKeyID sql.NullString

+ OAuthRefreshTokenKeyID sql.NullString

+ type InsertDBCryptKeyParams struct

+ ActiveKeyDigest string

+ Number int32

+ Test string

type InsertGitAuthLinkParams

+ OAuthAccessTokenKeyID sql.NullString

+ OAuthRefreshTokenKeyID sql.NullString

type InsertUserLinkParams

+ OAuthAccessTokenKeyID sql.NullString

+ OAuthRefreshTokenKeyID sql.NullString

+ type InsertWorkspaceAgentLogSourcesParams struct

+ CreatedAt time.Time

+ DisplayName []string

+ ID []uuid.UUID

+ Icon []string

+ WorkspaceAgentID uuid.UUID

type InsertWorkspaceAgentLogsParams

+ LogSourceID uuid.UUID

+ type InsertWorkspaceAgentScriptsParams struct

+ CreatedAt time.Time

+ Cron []string

+ LogPath []string

+ LogSourceID []uuid.UUID

+ RunOnStart []bool

+ RunOnStop []bool

+ Script []string

+ StartBlocksLogin []bool

+ TimeoutSeconds []int32

+ WorkspaceAgentID uuid.UUID

+ type TailnetClientSubscription struct

+ AgentID uuid.UUID

+ ClientID uuid.UUID

+ CoordinatorID uuid.UUID

+ UpdatedAt time.Time

type UniqueConstraint

+ const UniqueAPIKeysPkey

+ const UniqueAgentStatsPkey

+ const UniqueAuditLogsPkey

+ const UniqueDbcryptKeysActiveKeyDigestKey

+ const UniqueDbcryptKeysPkey

+ const UniqueDbcryptKeysRevokedKeyDigestKey

+ const UniqueFilesPkey

+ const UniqueGitSSHKeysPkey

+ const UniqueGroupsPkey

+ const UniqueIndexAPIKeyName

+ const UniqueLicensesPkey

+ const UniqueOrganizationMembersPkey

+ const UniqueOrganizationsPkey

+ const UniqueParameterSchemasPkey

+ const UniqueParameterValuesPkey

+ const UniqueProvisionerDaemonsPkey

+ const UniqueProvisionerJobLogsPkey

+ const UniqueProvisionerJobsPkey

+ const UniqueTailnetAgentsPkey

+ const UniqueTailnetClientSubscriptionsPkey

+ const UniqueTailnetClientsPkey

+ const UniqueTailnetCoordinatorsPkey

+ const UniqueTemplateVersionsPkey

+ const UniqueTemplatesPkey

+ const UniqueUserLinksPkey

+ const UniqueUsersPkey

+ const UniqueWorkspaceAgentLogSourcesPkey

+ const UniqueWorkspaceAgentMetadataPkey

+ const UniqueWorkspaceAgentStartupLogsPkey

+ const UniqueWorkspaceAgentsPkey

+ const UniqueWorkspaceAppStatsPkey

+ const UniqueWorkspaceAppsPkey

+ const UniqueWorkspaceBuildsPkey

+ const UniqueWorkspaceProxiesPkey

+ const UniqueWorkspaceResourceMetadataPkey

+ const UniqueWorkspaceResourcesPkey

+ const UniqueWorkspacesPkey

type UpdateGitAuthLinkParams

+ OAuthAccessTokenKeyID sql.NullString

+ OAuthRefreshTokenKeyID sql.NullString

type UpdateUserLinkParams

+ OAuthAccessTokenKeyID sql.NullString

+ OAuthRefreshTokenKeyID sql.NullString

+ type UpdateWorkspaceBuildDeadlineByIDParams struct

+ Deadline time.Time

+ ID uuid.UUID

+ MaxDeadline time.Time

+ UpdatedAt time.Time

+ type UpdateWorkspaceBuildProvisionerStateByIDParams struct

+ ID uuid.UUID

+ ProvisionerState []byte

+ UpdatedAt time.Time

+ type UpsertTailnetClientSubscriptionParams struct

+ AgentID uuid.UUID

+ ClientID uuid.UUID

+ CoordinatorID uuid.UUID

type UserLink

+ OAuthAccessTokenKeyID sql.NullString

+ OAuthRefreshTokenKeyID sql.NullString

type WorkspaceAgentLog

+ LogSourceID uuid.UUID

type WorkspaceAgentLogSource

+ CreatedAt time.Time

+ DisplayName string

+ ID uuid.UUID

+ Icon string

+ WorkspaceAgentID uuid.UUID

+ type WorkspaceAgentScript struct

+ CreatedAt time.Time

+ Cron string

+ LogPath string

+ LogSourceID uuid.UUID

+ RunOnStart bool

+ RunOnStop bool

+ Script string

+ StartBlocksLogin bool

+ TimeoutSeconds int32

+ WorkspaceAgentID uuid.UUID

Sep 5, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type DisplayApp string

+ const DisplayAppPortForwardingHelper

+ const DisplayAppSSHHelper

+ const DisplayAppVscode

+ const DisplayAppVscodeInsiders

+ const DisplayAppWebTerminal

+ func AllDisplayAppValues() []DisplayApp

+ func (e *DisplayApp) Scan(src interface{}) error

+ func (e DisplayApp) Valid() bool

type InsertWorkspaceAgentParams

+ DisplayApps []DisplayApp

+ type NullDisplayApp struct

+ DisplayApp DisplayApp

+ Valid bool

+ func (ns *NullDisplayApp) Scan(value interface{}) error

+ func (ns NullDisplayApp) Value() (driver.Value, error)

type Template

+ AutostopRequirementDaysOfWeek int16

+ AutostopRequirementWeeks int64

type TemplateTable

+ AutostopRequirementDaysOfWeek int16

+ AutostopRequirementWeeks int64

type UpdateTemplateScheduleByIDParams

+ AutostopRequirementDaysOfWeek int16

+ AutostopRequirementWeeks int64

type WorkspaceAgent

+ DisplayApps []DisplayApp

Aug 28, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

type GetWorkspacesParams

+ DormantAt time.Time

type GetWorkspacesRow

+ DormantAt sql.NullTime

type Template

+ TimeTilDormant int64

+ TimeTilDormantAutoDelete int64

type TemplateTable

+ TimeTilDormant int64

+ TimeTilDormantAutoDelete int64

type UpdateTemplateScheduleByIDParams

+ TimeTilDormant int64

+ TimeTilDormantAutoDelete int64

+ type UpdateWorkspaceDormantDeletingAtParams struct

+ DormantAt sql.NullTime

+ ID uuid.UUID

+ type UpdateWorkspacesDormantDeletingAtByTemplateIDParams struct

+ DormantAt time.Time

+ TemplateID uuid.UUID

+ TimeTilDormantAutodeleteMs int64

type Workspace

+ DormantAt sql.NullTime

+ func (w Workspace) DormantRBAC() rbac.Object

Aug 24, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Aug 23, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ type UpdateTemplateWorkspacesLastUsedAtParams struct

+ LastUsedAt time.Time

+ TemplateID uuid.UUID

+ type UpdateWorkspacesLockedDeletingAtByTemplateIDParams struct

+ LockedAt time.Time

+ LockedTtlMs int64

+ TemplateID uuid.UUID

Aug 22, 2023 GO-2024-2602 +19 more

  GO-2024-2602: Incorrect email domain verification in github.com/coder/coder

  GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

  GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

  GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

  GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

  GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

  GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

  GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

  GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

  GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

  GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

  GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

  GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

  GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

  GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

  GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

  GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

  GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

  GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

  GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Changes in this version

+ const EveryoneGroup

+ const LockIDDeploymentSetup

+ func GenLockID(name string) int64

+ func IsQueryCanceledError(err error) bool

+ func IsSerializedError(err error) bool

+ func IsUniqueViolation(err error, uniqueConstraints ...UniqueConstraint) bool

+ func IsWorkspaceAgentLogsLimitError(err error) bool

+ func Now() time.Time

+ func ReadModifyUpdate(db Store, f func(tx Store) error) error

+ func Time(t time.Time) time.Time

+ type APIKey struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ HashedSecret []byte

+ ID string

+ IPAddress pqtype.Inet

+ LastUsed time.Time

+ LifetimeSeconds int64

+ LoginType LoginType

+ Scope APIKeyScope

+ TokenName string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ func (k APIKey) RBACObject() rbac.Object

+ type APIKeyScope string

+ const APIKeyScopeAll

+ const APIKeyScopeApplicationConnect

+ func AllAPIKeyScopeValues() []APIKeyScope

+ func (e *APIKeyScope) Scan(src interface{}) error

+ func (e APIKeyScope) Valid() bool

+ func (s APIKeyScope) ToRBAC() rbac.ScopeName

+ type AcquireProvisionerJobParams struct

+ StartedAt sql.NullTime

+ Tags json.RawMessage

+ Types []ProvisionerType

+ WorkerID uuid.NullUUID

+ type Actions []rbac.Action

+ func (a *Actions) Scan(src interface{}) error

+ func (a *Actions) Value() (driver.Value, error)

+ type AppSharingLevel string

+ const AppSharingLevelAuthenticated

+ const AppSharingLevelOwner

+ const AppSharingLevelPublic

+ func AllAppSharingLevelValues() []AppSharingLevel

+ func (e *AppSharingLevel) Scan(src interface{}) error

+ func (e AppSharingLevel) Valid() bool

+ type AuditAction string

+ const AuditActionCreate

+ const AuditActionDelete

+ const AuditActionLogin

+ const AuditActionLogout

+ const AuditActionRegister

+ const AuditActionStart

+ const AuditActionStop

+ const AuditActionWrite

+ func AllAuditActionValues() []AuditAction

+ func (e *AuditAction) Scan(src interface{}) error

+ func (e AuditAction) Valid() bool

+ type AuditLog struct

+ Action AuditAction

+ AdditionalFields json.RawMessage

+ Diff json.RawMessage

+ ID uuid.UUID

+ Ip pqtype.Inet

+ OrganizationID uuid.UUID

+ RequestID uuid.UUID

+ ResourceID uuid.UUID

+ ResourceIcon string

+ ResourceTarget string

+ ResourceType ResourceType

+ StatusCode int32

+ Time time.Time

+ UserAgent sql.NullString

+ UserID uuid.UUID

+ type AuditOAuthConvertState struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ FromLoginType LoginType

+ ToLoginType LoginType

+ UserID uuid.UUID

+ type AuditableGroup struct

+ Members []GroupMember

+ type BuildReason string

+ const BuildReasonAutodelete

+ const BuildReasonAutolock

+ const BuildReasonAutostart

+ const BuildReasonAutostop

+ const BuildReasonFailedstop

+ const BuildReasonInitiator

+ func AllBuildReasonValues() []BuildReason

+ func (e *BuildReason) Scan(src interface{}) error

+ func (e BuildReason) Valid() bool

+ type DBTX interface

+ ExecContext func(context.Context, string, ...interface{}) (sql.Result, error)

+ GetContext func(ctx context.Context, dest interface{}, query string, args ...interface{}) error

+ PrepareContext func(context.Context, string) (*sql.Stmt, error)

+ QueryContext func(context.Context, string, ...interface{}) (*sql.Rows, error)

+ QueryRowContext func(context.Context, string, ...interface{}) *sql.Row

+ SelectContext func(ctx context.Context, dest interface{}, query string, args ...interface{}) error

+ type DeleteGroupMemberFromGroupParams struct

+ GroupID uuid.UUID

+ UserID uuid.UUID

+ type DeleteGroupMembersByOrgAndUserParams struct

+ OrganizationID uuid.UUID

+ UserID uuid.UUID

+ type DeleteTailnetAgentParams struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ type DeleteTailnetAgentRow struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ type DeleteTailnetClientParams struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ type DeleteTailnetClientRow struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ type File struct

+ CreatedAt time.Time

+ CreatedBy uuid.UUID

+ Data []byte

+ Hash string

+ ID uuid.UUID

+ Mimetype string

+ func (f File) RBACObject() rbac.Object

+ type GetAPIKeyByNameParams struct

+ TokenName string

+ UserID uuid.UUID

+ type GetAPIKeysByUserIDParams struct

+ LoginType LoginType

+ UserID uuid.UUID

+ type GetAuditLogsOffsetParams struct

+ Action string

+ BuildReason string

+ DateFrom time.Time

+ DateTo time.Time

+ Email string

+ Limit int32

+ Offset int32

+ ResourceID uuid.UUID

+ ResourceTarget string

+ ResourceType string

+ UserID uuid.UUID

+ Username string

+ type GetAuditLogsOffsetRow struct

+ Action AuditAction

+ AdditionalFields json.RawMessage

+ Count int64

+ Diff json.RawMessage

+ ID uuid.UUID

+ Ip pqtype.Inet

+ OrganizationID uuid.UUID

+ RequestID uuid.UUID

+ ResourceID uuid.UUID

+ ResourceIcon string

+ ResourceTarget string

+ ResourceType ResourceType

+ StatusCode int32

+ Time time.Time

+ UserAgent sql.NullString

+ UserAvatarUrl sql.NullString

+ UserCreatedAt sql.NullTime

+ UserEmail sql.NullString

+ UserID uuid.UUID

+ UserRoles pq.StringArray

+ UserStatus NullUserStatus

+ UserUsername sql.NullString

+ type GetAuthorizationUserRolesRow struct

+ Groups []string

+ ID uuid.UUID

+ Roles []string

+ Status UserStatus

+ Username string

+ type GetDefaultProxyConfigRow struct

+ DisplayName string

+ IconUrl string

+ type GetDeploymentDAUsRow struct

+ Date time.Time

+ UserID uuid.UUID

+ type GetDeploymentWorkspaceAgentStatsRow struct

+ SessionCountJetBrains int64

+ SessionCountReconnectingPTY int64

+ SessionCountSSH int64

+ SessionCountVSCode int64

+ WorkspaceConnectionLatency50 float64

+ WorkspaceConnectionLatency95 float64

+ WorkspaceRxBytes int64

+ WorkspaceTxBytes int64

+ type GetDeploymentWorkspaceStatsRow struct

+ BuildingWorkspaces int64

+ FailedWorkspaces int64

+ PendingWorkspaces int64

+ RunningWorkspaces int64

+ StoppedWorkspaces int64

+ type GetFileByHashAndCreatorParams struct

+ CreatedBy uuid.UUID

+ Hash string

+ type GetFileTemplatesRow struct

+ FileCreatedBy uuid.UUID

+ FileID uuid.UUID

+ GroupACL TemplateACL

+ TemplateCreatedBy uuid.UUID

+ TemplateID uuid.UUID

+ TemplateOrganizationID uuid.UUID

+ UserACL TemplateACL

+ func (t GetFileTemplatesRow) RBACObject() rbac.Object

+ type GetGitAuthLinkParams struct

+ ProviderID string

+ UserID uuid.UUID

+ type GetGroupByOrgAndNameParams struct

+ Name string

+ OrganizationID uuid.UUID

+ type GetOrganizationIDsByMemberIDsRow struct

+ OrganizationIDs []uuid.UUID

+ UserID uuid.UUID

+ func (m GetOrganizationIDsByMemberIDsRow) RBACObject() rbac.Object

+ type GetOrganizationMemberByUserIDParams struct

+ OrganizationID uuid.UUID

+ UserID uuid.UUID

+ type GetPreviousTemplateVersionParams struct

+ Name string

+ OrganizationID uuid.UUID

+ TemplateID uuid.NullUUID

+ type GetProvisionerJobsByIDsWithQueuePositionRow struct

+ ProvisionerJob ProvisionerJob

+ QueuePosition int64

+ QueueSize int64

+ type GetProvisionerLogsAfterIDParams struct

+ CreatedAfter int64

+ JobID uuid.UUID

+ type GetTemplateAppInsightsParams struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetTemplateAppInsightsRow struct

+ AccessMethod string

+ ActiveUserIDs []uuid.UUID

+ DisplayName sql.NullString

+ Icon sql.NullString

+ IsApp bool

+ SlugOrPort string

+ TemplateIDs []uuid.UUID

+ UsageSeconds int64

+ type GetTemplateAverageBuildTimeParams struct

+ StartTime sql.NullTime

+ TemplateID uuid.NullUUID

+ type GetTemplateAverageBuildTimeRow struct

+ Delete50 float64

+ Delete95 float64

+ Start50 float64

+ Start95 float64

+ Stop50 float64

+ Stop95 float64

+ type GetTemplateByOrganizationAndNameParams struct

+ Deleted bool

+ Name string

+ OrganizationID uuid.UUID

+ type GetTemplateDAUsParams struct

+ TemplateID uuid.UUID

+ TzOffset int32

+ type GetTemplateDAUsRow struct

+ Date time.Time

+ UserID uuid.UUID

+ type GetTemplateDailyInsightsParams struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetTemplateDailyInsightsRow struct

+ ActiveUsers int64

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetTemplateInsightsParams struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetTemplateInsightsRow struct

+ ActiveUserIDs []uuid.UUID

+ TemplateIDs []uuid.UUID

+ UsageJetbrainsSeconds int64

+ UsageReconnectingPtySeconds int64

+ UsageSshSeconds int64

+ UsageVscodeSeconds int64

+ type GetTemplateParameterInsightsParams struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetTemplateParameterInsightsRow struct

+ Count int64

+ Description string

+ DisplayName string

+ Name string

+ Num int64

+ Options json.RawMessage

+ TemplateIDs []uuid.UUID

+ Type string

+ Value string

+ type GetTemplateVersionByTemplateIDAndNameParams struct

+ Name string

+ TemplateID uuid.NullUUID

+ type GetTemplateVersionsByTemplateIDParams struct

+ AfterID uuid.UUID

+ LimitOpt int32

+ OffsetOpt int32

+ TemplateID uuid.UUID

+ type GetTemplatesWithFilterParams struct

+ Deleted bool

+ ExactName string

+ IDs []uuid.UUID

+ OrganizationID uuid.UUID

+ type GetUserByEmailOrUsernameParams struct

+ Email string

+ Username string

+ type GetUserLatencyInsightsParams struct

+ EndTime time.Time

+ StartTime time.Time

+ TemplateIDs []uuid.UUID

+ type GetUserLatencyInsightsRow struct

+ AvatarURL sql.NullString

+ TemplateIDs []uuid.UUID

+ UserID uuid.UUID

+ Username string

+ WorkspaceConnectionLatency50 float64

+ WorkspaceConnectionLatency95 float64

+ type GetUserLinkByUserIDLoginTypeParams struct

+ LoginType LoginType

+ UserID uuid.UUID

+ type GetUsersParams struct

+ AfterID uuid.UUID

+ LastSeenAfter time.Time

+ LastSeenBefore time.Time

+ LimitOpt int32

+ OffsetOpt int32

+ RbacRole []string

+ Search string

+ Status []UserStatus

+ type GetUsersRow struct

+ AvatarURL sql.NullString

+ Count int64

+ CreatedAt time.Time

+ Deleted bool

+ Email string

+ HashedPassword []byte

+ ID uuid.UUID

+ LastSeenAt time.Time

+ LoginType LoginType

+ QuietHoursSchedule string

+ RBACRoles pq.StringArray

+ Status UserStatus

+ UpdatedAt time.Time

+ Username string

+ func (u GetUsersRow) RBACObject() rbac.Object

+ type GetWorkspaceAgentAndOwnerByAuthTokenRow struct

+ OwnerGroups []string

+ OwnerID uuid.UUID

+ OwnerName string

+ OwnerRoles []string

+ OwnerStatus UserStatus

+ WorkspaceAgent WorkspaceAgent

+ WorkspaceID uuid.UUID

+ type GetWorkspaceAgentLifecycleStateByIDRow struct

+ LifecycleState WorkspaceAgentLifecycleState

+ ReadyAt sql.NullTime

+ StartedAt sql.NullTime

+ type GetWorkspaceAgentLogsAfterParams struct

+ AgentID uuid.UUID

+ CreatedAfter int64

+ type GetWorkspaceAgentStatsAndLabelsRow struct

+ AgentName string

+ ConnectionCount int64

+ ConnectionMedianLatencyMS float64

+ RxBytes int64

+ SessionCountJetBrains int64

+ SessionCountReconnectingPTY int64

+ SessionCountSSH int64

+ SessionCountVSCode int64

+ TxBytes int64

+ Username string

+ WorkspaceName string

+ type GetWorkspaceAgentStatsRow struct

+ AgentID uuid.UUID

+ AgentID_2 uuid.UUID

+ AggregatedFrom time.Time

+ SessionCountJetBrains int64

+ SessionCountReconnectingPTY int64

+ SessionCountSSH int64

+ SessionCountVSCode int64

+ TemplateID uuid.UUID

+ UserID uuid.UUID

+ WorkspaceConnectionLatency50 float64

+ WorkspaceConnectionLatency95 float64

+ WorkspaceID uuid.UUID

+ WorkspaceRxBytes int64

+ WorkspaceTxBytes int64

+ type GetWorkspaceAppByAgentIDAndSlugParams struct

+ AgentID uuid.UUID

+ Slug string

+ type GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams struct

+ BuildNumber int32

+ WorkspaceID uuid.UUID

+ type GetWorkspaceBuildsByWorkspaceIDParams struct

+ AfterID uuid.UUID

+ LimitOpt int32

+ OffsetOpt int32

+ Since time.Time

+ WorkspaceID uuid.UUID

+ type GetWorkspaceByOwnerIDAndNameParams struct

+ Deleted bool

+ Name string

+ OwnerID uuid.UUID

+ type GetWorkspaceProxyByHostnameParams struct

+ AllowAccessUrl bool

+ AllowWildcardHostname bool

+ Hostname string

+ type GetWorkspacesParams struct

+ AgentInactiveDisconnectTimeoutSeconds int64

+ Deleted bool

+ HasAgent string

+ LastUsedAfter time.Time

+ LastUsedBefore time.Time

+ Limit int32

+ LockedAt time.Time

+ Name string

+ Offset int32

+ OwnerID uuid.UUID

+ OwnerUsername string

+ Status string

+ TemplateIDs []uuid.UUID

+ TemplateName string

+ type GetWorkspacesRow struct

+ AutostartSchedule sql.NullString

+ Count int64

+ CreatedAt time.Time

+ Deleted bool

+ DeletingAt sql.NullTime

+ ID uuid.UUID

+ LastUsedAt time.Time

+ LockedAt sql.NullTime

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ TemplateID uuid.UUID

+ TemplateName string

+ TemplateVersionID uuid.UUID

+ TemplateVersionName sql.NullString

+ Ttl sql.NullInt64

+ UpdatedAt time.Time

+ type GitAuthLink struct

+ CreatedAt time.Time

+ OAuthAccessToken string

+ OAuthExpiry time.Time

+ OAuthRefreshToken string

+ ProviderID string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ func (u GitAuthLink) RBACObject() rbac.Object

+ type GitSSHKey struct

+ CreatedAt time.Time

+ PrivateKey string

+ PublicKey string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ func (u GitSSHKey) RBACObject() rbac.Object

+ type Group struct

+ AvatarURL string

+ DisplayName string

+ ID uuid.UUID

+ Name string

+ OrganizationID uuid.UUID

+ QuotaAllowance int32

+ Source GroupSource

+ func (g Group) Auditable(users []User) AuditableGroup

+ func (g Group) IsEveryone() bool

+ func (g Group) RBACObject() rbac.Object

+ type GroupMember struct

+ GroupID uuid.UUID

+ UserID uuid.UUID

+ type GroupSource string

+ const GroupSourceOidc

+ const GroupSourceUser

+ func AllGroupSourceValues() []GroupSource

+ func (e *GroupSource) Scan(src interface{}) error

+ func (e GroupSource) Valid() bool

+ type InsertAPIKeyParams struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ HashedSecret []byte

+ ID string

+ IPAddress pqtype.Inet

+ LastUsed time.Time

+ LifetimeSeconds int64

+ LoginType LoginType

+ Scope APIKeyScope

+ TokenName string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type InsertAuditLogParams struct

+ Action AuditAction

+ AdditionalFields json.RawMessage

+ Diff json.RawMessage

+ ID uuid.UUID

+ Ip pqtype.Inet

+ OrganizationID uuid.UUID

+ RequestID uuid.UUID

+ ResourceID uuid.UUID

+ ResourceIcon string

+ ResourceTarget string

+ ResourceType ResourceType

+ StatusCode int32

+ Time time.Time

+ UserAgent sql.NullString

+ UserID uuid.UUID

+ type InsertFileParams struct

+ CreatedAt time.Time

+ CreatedBy uuid.UUID

+ Data []byte

+ Hash string

+ ID uuid.UUID

+ Mimetype string

+ type InsertGitAuthLinkParams struct

+ CreatedAt time.Time

+ OAuthAccessToken string

+ OAuthExpiry time.Time

+ OAuthRefreshToken string

+ ProviderID string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type InsertGitSSHKeyParams struct

+ CreatedAt time.Time

+ PrivateKey string

+ PublicKey string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type InsertGroupMemberParams struct

+ GroupID uuid.UUID

+ UserID uuid.UUID

+ type InsertGroupParams struct

+ AvatarURL string

+ DisplayName string

+ ID uuid.UUID

+ Name string

+ OrganizationID uuid.UUID

+ QuotaAllowance int32

+ type InsertLicenseParams struct

+ Exp time.Time

+ JWT string

+ UUID uuid.UUID

+ UploadedAt time.Time

+ type InsertMissingGroupsParams struct

+ GroupNames []string

+ OrganizationID uuid.UUID

+ Source GroupSource

+ type InsertOrganizationMemberParams struct

+ CreatedAt time.Time

+ OrganizationID uuid.UUID

+ Roles []string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type InsertOrganizationParams struct

+ CreatedAt time.Time

+ Description string

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

+ type InsertProvisionerDaemonParams struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Name string

+ Provisioners []ProvisionerType

+ Tags StringMap

+ type InsertProvisionerJobLogsParams struct

+ CreatedAt []time.Time

+ JobID uuid.UUID

+ Level []LogLevel

+ Output []string

+ Source []LogSource

+ Stage []string

+ type InsertProvisionerJobParams struct

+ CreatedAt time.Time

+ FileID uuid.UUID

+ ID uuid.UUID

+ InitiatorID uuid.UUID

+ Input json.RawMessage

+ OrganizationID uuid.UUID

+ Provisioner ProvisionerType

+ StorageMethod ProvisionerStorageMethod

+ Tags StringMap

+ TraceMetadata pqtype.NullRawMessage

+ Type ProvisionerJobType

+ UpdatedAt time.Time

+ type InsertReplicaParams struct

+ CreatedAt time.Time

+ DatabaseLatency int32

+ Hostname string

+ ID uuid.UUID

+ Primary bool

+ RegionID int32

+ RelayAddress string

+ StartedAt time.Time

+ UpdatedAt time.Time

+ Version string

+ type InsertTemplateParams struct

+ ActiveVersionID uuid.UUID

+ AllowUserCancelWorkspaceJobs bool

+ CreatedAt time.Time

+ CreatedBy uuid.UUID

+ Description string

+ DisplayName string

+ GroupACL TemplateACL

+ ID uuid.UUID

+ Icon string

+ Name string

+ OrganizationID uuid.UUID

+ Provisioner ProvisionerType

+ UpdatedAt time.Time

+ UserACL TemplateACL

+ type InsertTemplateVersionParameterParams struct

+ DefaultValue string

+ Description string

+ DisplayName string

+ DisplayOrder int32

+ Ephemeral bool

+ Icon string

+ Mutable bool

+ Name string

+ Options json.RawMessage

+ Required bool

+ TemplateVersionID uuid.UUID

+ Type string

+ ValidationError string

+ ValidationMax sql.NullInt32

+ ValidationMin sql.NullInt32

+ ValidationMonotonic string

+ ValidationRegex string

+ type InsertTemplateVersionParams struct

+ CreatedAt time.Time

+ CreatedBy uuid.UUID

+ ID uuid.UUID

+ JobID uuid.UUID

+ Message string

+ Name string

+ OrganizationID uuid.UUID

+ Readme string

+ TemplateID uuid.NullUUID

+ UpdatedAt time.Time

+ type InsertTemplateVersionVariableParams struct

+ DefaultValue string

+ Description string

+ Name string

+ Required bool

+ Sensitive bool

+ TemplateVersionID uuid.UUID

+ Type string

+ Value string

+ type InsertUserGroupsByNameParams struct

+ GroupNames []string

+ OrganizationID uuid.UUID

+ UserID uuid.UUID

+ type InsertUserLinkParams struct

+ LinkedID string

+ LoginType LoginType

+ OAuthAccessToken string

+ OAuthExpiry time.Time

+ OAuthRefreshToken string

+ UserID uuid.UUID

+ type InsertUserParams struct

+ CreatedAt time.Time

+ Email string

+ HashedPassword []byte

+ ID uuid.UUID

+ LoginType LoginType

+ RBACRoles pq.StringArray

+ UpdatedAt time.Time

+ Username string

+ type InsertWorkspaceAgentLogsParams struct

+ AgentID uuid.UUID

+ CreatedAt []time.Time

+ Level []LogLevel

+ Output []string

+ OutputLength int32

+ Source []WorkspaceAgentLogSource

+ type InsertWorkspaceAgentMetadataParams struct

+ DisplayName string

+ Interval int64

+ Key string

+ Script string

+ Timeout int64

+ WorkspaceAgentID uuid.UUID

+ type InsertWorkspaceAgentParams struct

+ Architecture string

+ AuthInstanceID sql.NullString

+ AuthToken uuid.UUID

+ ConnectionTimeoutSeconds int32

+ CreatedAt time.Time

+ Directory string

+ EnvironmentVariables pqtype.NullRawMessage

+ ID uuid.UUID

+ InstanceMetadata pqtype.NullRawMessage

+ MOTDFile string

+ Name string

+ OperatingSystem string

+ ResourceID uuid.UUID

+ ResourceMetadata pqtype.NullRawMessage

+ ShutdownScript sql.NullString

+ ShutdownScriptTimeoutSeconds int32

+ StartupScript sql.NullString

+ StartupScriptBehavior StartupScriptBehavior

+ StartupScriptTimeoutSeconds int32

+ TroubleshootingURL string

+ UpdatedAt time.Time

+ type InsertWorkspaceAgentStatParams struct

+ AgentID uuid.UUID

+ ConnectionCount int64

+ ConnectionMedianLatencyMS float64

+ ConnectionsByProto json.RawMessage

+ CreatedAt time.Time

+ ID uuid.UUID

+ RxBytes int64

+ RxPackets int64

+ SessionCountJetBrains int64

+ SessionCountReconnectingPTY int64

+ SessionCountSSH int64

+ SessionCountVSCode int64

+ TemplateID uuid.UUID

+ TxBytes int64

+ TxPackets int64

+ UserID uuid.UUID

+ WorkspaceID uuid.UUID

+ type InsertWorkspaceAgentStatsParams struct

+ AgentID []uuid.UUID

+ ConnectionCount []int64

+ ConnectionMedianLatencyMS []float64

+ ConnectionsByProto json.RawMessage

+ CreatedAt []time.Time

+ ID []uuid.UUID

+ RxBytes []int64

+ RxPackets []int64

+ SessionCountJetBrains []int64

+ SessionCountReconnectingPTY []int64

+ SessionCountSSH []int64

+ SessionCountVSCode []int64

+ TemplateID []uuid.UUID

+ TxBytes []int64

+ TxPackets []int64

+ UserID []uuid.UUID

+ WorkspaceID []uuid.UUID

+ type InsertWorkspaceAppParams struct

+ AgentID uuid.UUID

+ Command sql.NullString

+ CreatedAt time.Time

+ DisplayName string

+ External bool

+ Health WorkspaceAppHealth

+ HealthcheckInterval int32

+ HealthcheckThreshold int32

+ HealthcheckUrl string

+ ID uuid.UUID

+ Icon string

+ SharingLevel AppSharingLevel

+ Slug string

+ Subdomain bool

+ Url sql.NullString

+ type InsertWorkspaceAppStatsParams struct

+ AccessMethod []string

+ AgentID []uuid.UUID

+ Requests []int32

+ SessionEndedAt []time.Time

+ SessionID []uuid.UUID

+ SessionStartedAt []time.Time

+ SlugOrPort []string

+ UserID []uuid.UUID

+ WorkspaceID []uuid.UUID

+ type InsertWorkspaceBuildParametersParams struct

+ Name []string

+ Value []string

+ WorkspaceBuildID uuid.UUID

+ type InsertWorkspaceBuildParams struct

+ BuildNumber int32

+ CreatedAt time.Time

+ Deadline time.Time

+ ID uuid.UUID

+ InitiatorID uuid.UUID

+ JobID uuid.UUID

+ MaxDeadline time.Time

+ ProvisionerState []byte

+ Reason BuildReason

+ TemplateVersionID uuid.UUID

+ Transition WorkspaceTransition

+ UpdatedAt time.Time

+ WorkspaceID uuid.UUID

+ type InsertWorkspaceParams struct

+ AutostartSchedule sql.NullString

+ CreatedAt time.Time

+ ID uuid.UUID

+ LastUsedAt time.Time

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ TemplateID uuid.UUID

+ Ttl sql.NullInt64

+ UpdatedAt time.Time

+ type InsertWorkspaceProxyParams struct

+ CreatedAt time.Time

+ DerpEnabled bool

+ DerpOnly bool

+ DisplayName string

+ ID uuid.UUID

+ Icon string

+ Name string

+ TokenHashedSecret []byte

+ UpdatedAt time.Time

+ type InsertWorkspaceResourceMetadataParams struct

+ Key []string

+ Sensitive []bool

+ Value []string

+ WorkspaceResourceID uuid.UUID

+ type InsertWorkspaceResourceParams struct

+ CreatedAt time.Time

+ DailyCost int32

+ Hide bool

+ ID uuid.UUID

+ Icon string

+ InstanceType sql.NullString

+ JobID uuid.UUID

+ Name string

+ Transition WorkspaceTransition

+ Type string

+ type License struct

+ Exp time.Time

+ ID int32

+ JWT string

+ UUID uuid.UUID

+ UploadedAt time.Time

+ func (l License) RBACObject() rbac.Object

+ type LogLevel string

+ const LogLevelDebug

+ const LogLevelError

+ const LogLevelInfo

+ const LogLevelTrace

+ const LogLevelWarn

+ func AllLogLevelValues() []LogLevel

+ func (e *LogLevel) Scan(src interface{}) error

+ func (e LogLevel) Valid() bool

+ type LogSource string

+ const LogSourceProvisioner

+ const LogSourceProvisionerDaemon

+ func AllLogSourceValues() []LogSource

+ func (e *LogSource) Scan(src interface{}) error

+ func (e LogSource) Valid() bool

+ type LoginType string

+ const LoginTypeGithub

+ const LoginTypeNone

+ const LoginTypeOIDC

+ const LoginTypePassword

+ const LoginTypeToken

+ func AllLoginTypeValues() []LoginType

+ func (e *LoginType) Scan(src interface{}) error

+ func (e LoginType) Valid() bool

+ type NullAPIKeyScope struct

+ APIKeyScope APIKeyScope

+ Valid bool

+ func (ns *NullAPIKeyScope) Scan(value interface{}) error

+ func (ns NullAPIKeyScope) Value() (driver.Value, error)

+ type NullAppSharingLevel struct

+ AppSharingLevel AppSharingLevel

+ Valid bool

+ func (ns *NullAppSharingLevel) Scan(value interface{}) error

+ func (ns NullAppSharingLevel) Value() (driver.Value, error)

+ type NullAuditAction struct

+ AuditAction AuditAction

+ Valid bool

+ func (ns *NullAuditAction) Scan(value interface{}) error

+ func (ns NullAuditAction) Value() (driver.Value, error)

+ type NullBuildReason struct

+ BuildReason BuildReason

+ Valid bool

+ func (ns *NullBuildReason) Scan(value interface{}) error

+ func (ns NullBuildReason) Value() (driver.Value, error)

+ type NullGroupSource struct

+ GroupSource GroupSource

+ Valid bool

+ func (ns *NullGroupSource) Scan(value interface{}) error

+ func (ns NullGroupSource) Value() (driver.Value, error)

+ type NullLogLevel struct

+ LogLevel LogLevel

+ Valid bool

+ func (ns *NullLogLevel) Scan(value interface{}) error

+ func (ns NullLogLevel) Value() (driver.Value, error)

+ type NullLogSource struct

+ LogSource LogSource

+ Valid bool

+ func (ns *NullLogSource) Scan(value interface{}) error

+ func (ns NullLogSource) Value() (driver.Value, error)

+ type NullLoginType struct

+ LoginType LoginType

+ Valid bool

+ func (ns *NullLoginType) Scan(value interface{}) error

+ func (ns NullLoginType) Value() (driver.Value, error)

+ type NullParameterDestinationScheme struct

+ ParameterDestinationScheme ParameterDestinationScheme

+ Valid bool

+ func (ns *NullParameterDestinationScheme) Scan(value interface{}) error

+ func (ns NullParameterDestinationScheme) Value() (driver.Value, error)

+ type NullParameterScope struct

+ ParameterScope ParameterScope

+ Valid bool

+ func (ns *NullParameterScope) Scan(value interface{}) error

+ func (ns NullParameterScope) Value() (driver.Value, error)

+ type NullParameterSourceScheme struct

+ ParameterSourceScheme ParameterSourceScheme

+ Valid bool

+ func (ns *NullParameterSourceScheme) Scan(value interface{}) error

+ func (ns NullParameterSourceScheme) Value() (driver.Value, error)

+ type NullParameterTypeSystem struct

+ ParameterTypeSystem ParameterTypeSystem

+ Valid bool

+ func (ns *NullParameterTypeSystem) Scan(value interface{}) error

+ func (ns NullParameterTypeSystem) Value() (driver.Value, error)

+ type NullProvisionerJobType struct

+ ProvisionerJobType ProvisionerJobType

+ Valid bool

+ func (ns *NullProvisionerJobType) Scan(value interface{}) error

+ func (ns NullProvisionerJobType) Value() (driver.Value, error)

+ type NullProvisionerStorageMethod struct

+ ProvisionerStorageMethod ProvisionerStorageMethod

+ Valid bool

+ func (ns *NullProvisionerStorageMethod) Scan(value interface{}) error

+ func (ns NullProvisionerStorageMethod) Value() (driver.Value, error)

+ type NullProvisionerType struct

+ ProvisionerType ProvisionerType

+ Valid bool

+ func (ns *NullProvisionerType) Scan(value interface{}) error

+ func (ns NullProvisionerType) Value() (driver.Value, error)

+ type NullResourceType struct

+ ResourceType ResourceType

+ Valid bool

+ func (ns *NullResourceType) Scan(value interface{}) error

+ func (ns NullResourceType) Value() (driver.Value, error)

+ type NullStartupScriptBehavior struct

+ StartupScriptBehavior StartupScriptBehavior

+ Valid bool

+ func (ns *NullStartupScriptBehavior) Scan(value interface{}) error

+ func (ns NullStartupScriptBehavior) Value() (driver.Value, error)

+ type NullUserStatus struct

+ UserStatus UserStatus

+ Valid bool

+ func (ns *NullUserStatus) Scan(value interface{}) error

+ func (ns NullUserStatus) Value() (driver.Value, error)

+ type NullWorkspaceAgentLifecycleState struct

+ Valid bool

+ WorkspaceAgentLifecycleState WorkspaceAgentLifecycleState

+ func (ns *NullWorkspaceAgentLifecycleState) Scan(value interface{}) error

+ func (ns NullWorkspaceAgentLifecycleState) Value() (driver.Value, error)

+ type NullWorkspaceAgentLogSource struct

+ Valid bool

+ WorkspaceAgentLogSource WorkspaceAgentLogSource

+ func (ns *NullWorkspaceAgentLogSource) Scan(value interface{}) error

+ func (ns NullWorkspaceAgentLogSource) Value() (driver.Value, error)

+ type NullWorkspaceAgentSubsystem struct

+ Valid bool

+ WorkspaceAgentSubsystem WorkspaceAgentSubsystem

+ func (ns *NullWorkspaceAgentSubsystem) Scan(value interface{}) error

+ func (ns NullWorkspaceAgentSubsystem) Value() (driver.Value, error)

+ type NullWorkspaceAppHealth struct

+ Valid bool

+ WorkspaceAppHealth WorkspaceAppHealth

+ func (ns *NullWorkspaceAppHealth) Scan(value interface{}) error

+ func (ns NullWorkspaceAppHealth) Value() (driver.Value, error)

+ type NullWorkspaceTransition struct

+ Valid bool

+ WorkspaceTransition WorkspaceTransition

+ func (ns *NullWorkspaceTransition) Scan(value interface{}) error

+ func (ns NullWorkspaceTransition) Value() (driver.Value, error)

+ type Organization struct

+ CreatedAt time.Time

+ Description string

+ ID uuid.UUID

+ Name string

+ UpdatedAt time.Time

+ func (o Organization) RBACObject() rbac.Object

+ type OrganizationMember struct

+ CreatedAt time.Time

+ OrganizationID uuid.UUID

+ Roles []string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ func (m OrganizationMember) RBACObject() rbac.Object

+ type ParameterDestinationScheme string

+ const ParameterDestinationSchemeEnvironmentVariable

+ const ParameterDestinationSchemeNone

+ const ParameterDestinationSchemeProvisionerVariable

+ func AllParameterDestinationSchemeValues() []ParameterDestinationScheme

+ func (e *ParameterDestinationScheme) Scan(src interface{}) error

+ func (e ParameterDestinationScheme) Valid() bool

+ type ParameterSchema struct

+ AllowOverrideDestination bool

+ AllowOverrideSource bool

+ CreatedAt time.Time

+ DefaultDestinationScheme ParameterDestinationScheme

+ DefaultRefresh string

+ DefaultSourceScheme ParameterSourceScheme

+ DefaultSourceValue string

+ Description string

+ ID uuid.UUID

+ Index int32

+ JobID uuid.UUID

+ Name string

+ RedisplayValue bool

+ ValidationCondition string

+ ValidationError string

+ ValidationTypeSystem ParameterTypeSystem

+ ValidationValueType string

+ type ParameterScope string

+ const ParameterScopeImportJob

+ const ParameterScopeTemplate

+ const ParameterScopeWorkspace

+ func AllParameterScopeValues() []ParameterScope

+ func (e *ParameterScope) Scan(src interface{}) error

+ func (e ParameterScope) Valid() bool

+ type ParameterSourceScheme string

+ const ParameterSourceSchemeData

+ const ParameterSourceSchemeNone

+ func AllParameterSourceSchemeValues() []ParameterSourceScheme

+ func (e *ParameterSourceScheme) Scan(src interface{}) error

+ func (e ParameterSourceScheme) Valid() bool

+ type ParameterTypeSystem string

+ const ParameterTypeSystemHCL

+ const ParameterTypeSystemNone

+ func AllParameterTypeSystemValues() []ParameterTypeSystem

+ func (e *ParameterTypeSystem) Scan(src interface{}) error

+ func (e ParameterTypeSystem) Valid() bool

+ type ParameterValue struct

+ CreatedAt time.Time

+ DestinationScheme ParameterDestinationScheme

+ ID uuid.UUID

+ Name string

+ Scope ParameterScope

+ ScopeID uuid.UUID

+ SourceScheme ParameterSourceScheme

+ SourceValue string

+ UpdatedAt time.Time

+ type ProvisionerDaemon struct

+ CreatedAt time.Time

+ ID uuid.UUID

+ Name string

+ Provisioners []ProvisionerType

+ ReplicaID uuid.NullUUID

+ Tags StringMap

+ UpdatedAt sql.NullTime

+ func (p ProvisionerDaemon) RBACObject() rbac.Object

+ type ProvisionerJob struct

+ CanceledAt sql.NullTime

+ CompletedAt sql.NullTime

+ CreatedAt time.Time

+ Error sql.NullString

+ ErrorCode sql.NullString

+ FileID uuid.UUID

+ ID uuid.UUID

+ InitiatorID uuid.UUID

+ Input json.RawMessage

+ OrganizationID uuid.UUID

+ Provisioner ProvisionerType

+ StartedAt sql.NullTime

+ StorageMethod ProvisionerStorageMethod

+ Tags StringMap

+ TraceMetadata pqtype.NullRawMessage

+ Type ProvisionerJobType

+ UpdatedAt time.Time

+ WorkerID uuid.NullUUID

+ type ProvisionerJobLog struct

+ CreatedAt time.Time

+ ID int64

+ JobID uuid.UUID

+ Level LogLevel

+ Output string

+ Source LogSource

+ Stage string

+ type ProvisionerJobType string

+ const ProvisionerJobTypeTemplateVersionDryRun

+ const ProvisionerJobTypeTemplateVersionImport

+ const ProvisionerJobTypeWorkspaceBuild

+ func AllProvisionerJobTypeValues() []ProvisionerJobType

+ func (e *ProvisionerJobType) Scan(src interface{}) error

+ func (e ProvisionerJobType) Valid() bool

+ type ProvisionerStorageMethod string

+ const ProvisionerStorageMethodFile

+ func AllProvisionerStorageMethodValues() []ProvisionerStorageMethod

+ func (e *ProvisionerStorageMethod) Scan(src interface{}) error

+ func (e ProvisionerStorageMethod) Valid() bool

+ type ProvisionerType string

+ const ProvisionerTypeEcho

+ const ProvisionerTypeTerraform

+ func AllProvisionerTypeValues() []ProvisionerType

+ func (e *ProvisionerType) Scan(src interface{}) error

+ func (e ProvisionerType) Valid() bool

+ type RegisterWorkspaceProxyParams struct

+ DerpEnabled bool

+ DerpOnly bool

+ ID uuid.UUID

+ Url string

+ WildcardHostname string

+ type Replica struct

+ CreatedAt time.Time

+ DatabaseLatency int32

+ Error string

+ Hostname string

+ ID uuid.UUID

+ Primary bool

+ RegionID int32

+ RelayAddress string

+ StartedAt time.Time

+ StoppedAt sql.NullTime

+ UpdatedAt time.Time

+ Version string

+ type ResourceType string

+ const ResourceTypeApiKey

+ const ResourceTypeConvertLogin

+ const ResourceTypeGitSshKey

+ const ResourceTypeGroup

+ const ResourceTypeLicense

+ const ResourceTypeOrganization

+ const ResourceTypeTemplate

+ const ResourceTypeTemplateVersion

+ const ResourceTypeUser

+ const ResourceTypeWorkspace

+ const ResourceTypeWorkspaceBuild

+ const ResourceTypeWorkspaceProxy

+ func AllResourceTypeValues() []ResourceType

+ func (e *ResourceType) Scan(src interface{}) error

+ func (e ResourceType) Valid() bool

+ type SiteConfig struct

+ Key string

+ Value string

+ type StartupScriptBehavior string

+ const StartupScriptBehaviorBlocking

+ const StartupScriptBehaviorNonBlocking

+ func AllStartupScriptBehaviorValues() []StartupScriptBehavior

+ func (e *StartupScriptBehavior) Scan(src interface{}) error

+ func (e StartupScriptBehavior) Valid() bool

+ type Store interface

+ InTx func(func(Store) error, *sql.TxOptions) error

+ Ping func(ctx context.Context) (time.Duration, error)

+ func New(sdb *sql.DB) Store

+ type StringMap map[string]string

+ func (m *StringMap) Scan(src interface{}) error

+ func (m StringMap) Value() (driver.Value, error)

+ type TailnetAgent struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ Node json.RawMessage

+ UpdatedAt time.Time

+ type TailnetClient struct

+ AgentID uuid.UUID

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ Node json.RawMessage

+ UpdatedAt time.Time

+ type TailnetCoordinator struct

+ HeartbeatAt time.Time

+ ID uuid.UUID

+ type Template struct

+ ActiveVersionID uuid.UUID

+ AllowUserAutostart bool

+ AllowUserAutostop bool

+ AllowUserCancelWorkspaceJobs bool

+ CreatedAt time.Time

+ CreatedBy uuid.UUID

+ CreatedByAvatarURL sql.NullString

+ CreatedByUsername string

+ DefaultTTL int64

+ Deleted bool

+ Description string

+ DisplayName string

+ FailureTTL int64

+ GroupACL TemplateACL

+ ID uuid.UUID

+ Icon string

+ InactivityTTL int64

+ LockedTTL int64

+ MaxTTL int64

+ Name string

+ OrganizationID uuid.UUID

+ Provisioner ProvisionerType

+ RestartRequirementDaysOfWeek int16

+ RestartRequirementWeeks int64

+ UpdatedAt time.Time

+ UserACL TemplateACL

+ func (t Template) DeepCopy() Template

+ func (t Template) RBACObject() rbac.Object

+ type TemplateACL map[string][]rbac.Action

+ func (t *TemplateACL) Scan(src interface{}) error

+ func (t TemplateACL) Value() (driver.Value, error)

+ type TemplateGroup struct

+ Actions Actions

+ type TemplateTable struct

+ ActiveVersionID uuid.UUID

+ AllowUserAutostart bool

+ AllowUserAutostop bool

+ AllowUserCancelWorkspaceJobs bool

+ CreatedAt time.Time

+ CreatedBy uuid.UUID

+ DefaultTTL int64

+ Deleted bool

+ Description string

+ DisplayName string

+ FailureTTL int64

+ GroupACL TemplateACL

+ ID uuid.UUID

+ Icon string

+ InactivityTTL int64

+ LockedTTL int64

+ MaxTTL int64

+ Name string

+ OrganizationID uuid.UUID

+ Provisioner ProvisionerType

+ RestartRequirementDaysOfWeek int16

+ RestartRequirementWeeks int64

+ UpdatedAt time.Time

+ UserACL TemplateACL

+ type TemplateUser struct

+ Actions Actions

+ type TemplateVersion struct

+ CreatedAt time.Time

+ CreatedBy uuid.UUID

+ CreatedByAvatarURL sql.NullString

+ CreatedByUsername string

+ GitAuthProviders []string

+ ID uuid.UUID

+ JobID uuid.UUID

+ Message string

+ Name string

+ OrganizationID uuid.UUID

+ Readme string

+ TemplateID uuid.NullUUID

+ UpdatedAt time.Time

+ func (TemplateVersion) RBACObject(template Template) rbac.Object

+ func (v TemplateVersion) RBACObjectNoTemplate() rbac.Object

+ type TemplateVersionParameter struct

+ DefaultValue string

+ Description string

+ DisplayName string

+ DisplayOrder int32

+ Ephemeral bool

+ Icon string

+ Mutable bool

+ Name string

+ Options json.RawMessage

+ Required bool

+ TemplateVersionID uuid.UUID

+ Type string

+ ValidationError string

+ ValidationMax sql.NullInt32

+ ValidationMin sql.NullInt32

+ ValidationMonotonic string

+ ValidationRegex string

+ type TemplateVersionTable struct

+ CreatedAt time.Time

+ CreatedBy uuid.UUID

+ GitAuthProviders []string

+ ID uuid.UUID

+ JobID uuid.UUID

+ Message string

+ Name string

+ OrganizationID uuid.UUID

+ Readme string

+ TemplateID uuid.NullUUID

+ UpdatedAt time.Time

+ type TemplateVersionVariable struct

+ DefaultValue string

+ Description string

+ Name string

+ Required bool

+ Sensitive bool

+ TemplateVersionID uuid.UUID

+ Type string

+ Value string

+ type UniqueConstraint string

+ const UniqueFilesHashCreatedByKey

+ const UniqueGitAuthLinksProviderIDUserIDKey

+ const UniqueGroupMembersUserIDGroupIDKey

+ const UniqueGroupsNameOrganizationIDKey

+ const UniqueIndexApiKeyName

+ const UniqueIndexOrganizationName

+ const UniqueIndexOrganizationNameLower

+ const UniqueIndexUsersEmail

+ const UniqueIndexUsersUsername

+ const UniqueLicensesJWTKey

+ const UniqueParameterSchemasJobIDNameKey

+ const UniqueParameterValuesScopeIDNameKey

+ const UniqueProvisionerDaemonsNameKey

+ const UniqueSiteConfigsKeyKey

+ const UniqueTemplateVersionParametersTemplateVersionIDNameKey

+ const UniqueTemplateVersionVariablesTemplateVersionIDNameKey

+ const UniqueTemplateVersionsTemplateIDNameKey

+ const UniqueTemplatesOrganizationIDNameIndex

+ const UniqueUsersEmailLowerIndex

+ const UniqueUsersUsernameLowerIndex

+ const UniqueWorkspaceAppStatsUserIDAgentIDSessionIDKey

+ const UniqueWorkspaceAppsAgentIDSlugIndex

+ const UniqueWorkspaceBuildParametersWorkspaceBuildIDNameKey

+ const UniqueWorkspaceBuildsJobIDKey

+ const UniqueWorkspaceBuildsWorkspaceIDBuildNumberKey

+ const UniqueWorkspaceProxiesLowerNameIndex

+ const UniqueWorkspaceProxiesRegionIDUnique

+ const UniqueWorkspaceResourceMetadataName

+ const UniqueWorkspacesOwnerIDLowerIndex

+ type UpdateAPIKeyByIDParams struct

+ ExpiresAt time.Time

+ ID string

+ IPAddress pqtype.Inet

+ LastUsed time.Time

+ type UpdateGitAuthLinkParams struct

+ OAuthAccessToken string

+ OAuthExpiry time.Time

+ OAuthRefreshToken string

+ ProviderID string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type UpdateGitSSHKeyParams struct

+ PrivateKey string

+ PublicKey string

+ UpdatedAt time.Time

+ UserID uuid.UUID

+ type UpdateGroupByIDParams struct

+ AvatarURL string

+ DisplayName string

+ ID uuid.UUID

+ Name string

+ QuotaAllowance int32

+ type UpdateInactiveUsersToDormantParams struct

+ LastSeenAfter time.Time

+ UpdatedAt time.Time

+ type UpdateInactiveUsersToDormantRow struct

+ Email string

+ ID uuid.UUID

+ LastSeenAt time.Time

+ type UpdateMemberRolesParams struct

+ GrantedRoles []string

+ OrgID uuid.UUID

+ UserID uuid.UUID

+ type UpdateProvisionerJobByIDParams struct

+ ID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateProvisionerJobWithCancelByIDParams struct

+ CanceledAt sql.NullTime

+ CompletedAt sql.NullTime

+ ID uuid.UUID

+ type UpdateProvisionerJobWithCompleteByIDParams struct

+ CompletedAt sql.NullTime

+ Error sql.NullString

+ ErrorCode sql.NullString

+ ID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateReplicaParams struct

+ DatabaseLatency int32

+ Error string

+ Hostname string

+ ID uuid.UUID

+ Primary bool

+ RegionID int32

+ RelayAddress string

+ StartedAt time.Time

+ StoppedAt sql.NullTime

+ UpdatedAt time.Time

+ Version string

+ type UpdateTemplateACLByIDParams struct

+ GroupACL TemplateACL

+ ID uuid.UUID

+ UserACL TemplateACL

+ type UpdateTemplateActiveVersionByIDParams struct

+ ActiveVersionID uuid.UUID

+ ID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateTemplateDeletedByIDParams struct

+ Deleted bool

+ ID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateTemplateMetaByIDParams struct

+ AllowUserCancelWorkspaceJobs bool

+ Description string

+ DisplayName string

+ ID uuid.UUID

+ Icon string

+ Name string

+ UpdatedAt time.Time

+ type UpdateTemplateScheduleByIDParams struct

+ AllowUserAutostart bool

+ AllowUserAutostop bool

+ DefaultTTL int64

+ FailureTTL int64

+ ID uuid.UUID

+ InactivityTTL int64

+ LockedTTL int64

+ MaxTTL int64

+ RestartRequirementDaysOfWeek int16

+ RestartRequirementWeeks int64

+ UpdatedAt time.Time

+ type UpdateTemplateVersionByIDParams struct

+ ID uuid.UUID

+ Message string

+ Name string

+ TemplateID uuid.NullUUID

+ UpdatedAt time.Time

+ type UpdateTemplateVersionDescriptionByJobIDParams struct

+ JobID uuid.UUID

+ Readme string

+ UpdatedAt time.Time

+ type UpdateTemplateVersionGitAuthProvidersByJobIDParams struct

+ GitAuthProviders []string

+ JobID uuid.UUID

+ UpdatedAt time.Time

+ type UpdateUserDeletedByIDParams struct

+ Deleted bool

+ ID uuid.UUID

+ type UpdateUserHashedPasswordParams struct

+ HashedPassword []byte

+ ID uuid.UUID

+ type UpdateUserLastSeenAtParams struct

+ ID uuid.UUID

+ LastSeenAt time.Time

+ UpdatedAt time.Time

+ type UpdateUserLinkParams struct

+ LoginType LoginType

+ OAuthAccessToken string

+ OAuthExpiry time.Time

+ OAuthRefreshToken string

+ UserID uuid.UUID

+ type UpdateUserLinkedIDParams struct

+ LinkedID string

+ LoginType LoginType

+ UserID uuid.UUID

+ type UpdateUserLoginTypeParams struct

+ NewLoginType LoginType

+ UserID uuid.UUID

+ type UpdateUserProfileParams struct

+ AvatarURL sql.NullString

+ Email string

+ ID uuid.UUID

+ UpdatedAt time.Time

+ Username string

+ type UpdateUserQuietHoursScheduleParams struct

+ ID uuid.UUID

+ QuietHoursSchedule string

+ type UpdateUserRolesParams struct

+ GrantedRoles []string

+ ID uuid.UUID

+ type UpdateUserStatusParams struct

+ ID uuid.UUID

+ Status UserStatus

+ UpdatedAt time.Time

+ type UpdateWorkspaceAgentConnectionByIDParams struct

+ DisconnectedAt sql.NullTime

+ FirstConnectedAt sql.NullTime

+ ID uuid.UUID

+ LastConnectedAt sql.NullTime

+ LastConnectedReplicaID uuid.NullUUID

+ UpdatedAt time.Time

+ type UpdateWorkspaceAgentLifecycleStateByIDParams struct

+ ID uuid.UUID

+ LifecycleState WorkspaceAgentLifecycleState

+ ReadyAt sql.NullTime

+ StartedAt sql.NullTime

+ type UpdateWorkspaceAgentLogOverflowByIDParams struct

+ ID uuid.UUID

+ LogsOverflowed bool

+ type UpdateWorkspaceAgentMetadataParams struct

+ CollectedAt time.Time

+ Error string

+ Key string

+ Value string

+ WorkspaceAgentID uuid.UUID

+ type UpdateWorkspaceAgentStartupByIDParams struct

+ ExpandedDirectory string

+ ID uuid.UUID

+ Subsystems []WorkspaceAgentSubsystem

+ Version string

+ type UpdateWorkspaceAppHealthByIDParams struct

+ Health WorkspaceAppHealth

+ ID uuid.UUID

+ type UpdateWorkspaceAutostartParams struct

+ AutostartSchedule sql.NullString

+ ID uuid.UUID

+ type UpdateWorkspaceBuildByIDParams struct

+ Deadline time.Time

+ ID uuid.UUID

+ MaxDeadline time.Time

+ ProvisionerState []byte

+ UpdatedAt time.Time

+ type UpdateWorkspaceBuildCostByIDParams struct

+ DailyCost int32

+ ID uuid.UUID

+ type UpdateWorkspaceDeletedByIDParams struct

+ Deleted bool

+ ID uuid.UUID

+ type UpdateWorkspaceLastUsedAtParams struct

+ ID uuid.UUID

+ LastUsedAt time.Time

+ type UpdateWorkspaceLockedDeletingAtParams struct

+ ID uuid.UUID

+ LockedAt sql.NullTime

+ type UpdateWorkspaceParams struct

+ ID uuid.UUID

+ Name string

+ type UpdateWorkspaceProxyDeletedParams struct

+ Deleted bool

+ ID uuid.UUID

+ type UpdateWorkspaceProxyParams struct

+ DisplayName string

+ ID uuid.UUID

+ Icon string

+ Name string

+ TokenHashedSecret []byte

+ type UpdateWorkspaceTTLParams struct

+ ID uuid.UUID

+ Ttl sql.NullInt64

+ type UpdateWorkspacesDeletingAtByTemplateIDParams struct

+ LockedTtlMs int64

+ TemplateID uuid.UUID

+ type UpsertDefaultProxyParams struct

+ DisplayName string

+ IconUrl string

+ type UpsertTailnetAgentParams struct

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ Node json.RawMessage

+ type UpsertTailnetClientParams struct

+ AgentID uuid.UUID

+ CoordinatorID uuid.UUID

+ ID uuid.UUID

+ Node json.RawMessage

+ type User struct

+ AvatarURL sql.NullString

+ CreatedAt time.Time

+ Deleted bool

+ Email string

+ HashedPassword []byte

+ ID uuid.UUID

+ LastSeenAt time.Time

+ LoginType LoginType

+ QuietHoursSchedule string

+ RBACRoles pq.StringArray

+ Status UserStatus

+ UpdatedAt time.Time

+ Username string

+ func ConvertUserRows(rows []GetUsersRow) []User

+ func (u User) RBACObject() rbac.Object

+ func (u User) UserDataRBACObject() rbac.Object

+ type UserLink struct

+ LinkedID string

+ LoginType LoginType

+ OAuthAccessToken string

+ OAuthExpiry time.Time

+ OAuthRefreshToken string

+ UserID uuid.UUID

+ func (u UserLink) RBACObject() rbac.Object

+ type UserStatus string

+ const UserStatusActive

+ const UserStatusDormant

+ const UserStatusSuspended

+ func AllUserStatusValues() []UserStatus

+ func (e *UserStatus) Scan(src interface{}) error

+ func (e UserStatus) Valid() bool

+ type VisibleUser struct

+ AvatarURL sql.NullString

+ ID uuid.UUID

+ Username string

+ type Workspace struct

+ AutostartSchedule sql.NullString

+ CreatedAt time.Time

+ Deleted bool

+ DeletingAt sql.NullTime

+ ID uuid.UUID

+ LastUsedAt time.Time

+ LockedAt sql.NullTime

+ Name string

+ OrganizationID uuid.UUID

+ OwnerID uuid.UUID

+ TemplateID uuid.UUID

+ Ttl sql.NullInt64

+ UpdatedAt time.Time

+ func ConvertWorkspaceRows(rows []GetWorkspacesRow) []Workspace

+ func (w Workspace) ApplicationConnectRBAC() rbac.Object

+ func (w Workspace) ExecutionRBAC() rbac.Object

+ func (w Workspace) LockedRBAC() rbac.Object

+ func (w Workspace) RBACObject() rbac.Object

+ func (w Workspace) WorkspaceBuildRBAC(transition WorkspaceTransition) rbac.Object

+ type WorkspaceAgent struct

+ Architecture string

+ AuthInstanceID sql.NullString

+ AuthToken uuid.UUID

+ ConnectionTimeoutSeconds int32

+ CreatedAt time.Time

+ Directory string

+ DisconnectedAt sql.NullTime

+ EnvironmentVariables pqtype.NullRawMessage

+ ExpandedDirectory string

+ FirstConnectedAt sql.NullTime

+ ID uuid.UUID

+ InstanceMetadata pqtype.NullRawMessage

+ LastConnectedAt sql.NullTime

+ LastConnectedReplicaID uuid.NullUUID

+ LifecycleState WorkspaceAgentLifecycleState

+ LogsLength int32

+ LogsOverflowed bool

+ MOTDFile string

+ Name string

+ OperatingSystem string

+ ReadyAt sql.NullTime

+ ResourceID uuid.UUID

+ ResourceMetadata pqtype.NullRawMessage

+ ShutdownScript sql.NullString

+ ShutdownScriptTimeoutSeconds int32

+ StartedAt sql.NullTime

+ StartupScript sql.NullString

+ StartupScriptBehavior StartupScriptBehavior

+ StartupScriptTimeoutSeconds int32

+ Subsystems []WorkspaceAgentSubsystem

+ TroubleshootingURL string

+ UpdatedAt time.Time

+ Version string

+ func (a WorkspaceAgent) Status(inactiveTimeout time.Duration) WorkspaceAgentConnectionStatus

+ type WorkspaceAgentConnectionStatus struct

+ DisconnectedAt *time.Time

+ FirstConnectedAt *time.Time

+ LastConnectedAt *time.Time

+ Status WorkspaceAgentStatus

+ type WorkspaceAgentLifecycleState string

+ const WorkspaceAgentLifecycleStateCreated

+ const WorkspaceAgentLifecycleStateOff

+ const WorkspaceAgentLifecycleStateReady

+ const WorkspaceAgentLifecycleStateShutdownError

+ const WorkspaceAgentLifecycleStateShutdownTimeout

+ const WorkspaceAgentLifecycleStateShuttingDown

+ const WorkspaceAgentLifecycleStateStartError

+ const WorkspaceAgentLifecycleStateStartTimeout

+ const WorkspaceAgentLifecycleStateStarting

+ func AllWorkspaceAgentLifecycleStateValues() []WorkspaceAgentLifecycleState

+ func (e *WorkspaceAgentLifecycleState) Scan(src interface{}) error

+ func (e WorkspaceAgentLifecycleState) Valid() bool

+ type WorkspaceAgentLog struct

+ AgentID uuid.UUID

+ CreatedAt time.Time

+ ID int64

+ Level LogLevel

+ Output string

+ Source WorkspaceAgentLogSource

+ type WorkspaceAgentLogSource string

+ const WorkspaceAgentLogSourceEnvbox

+ const WorkspaceAgentLogSourceEnvbuilder

+ const WorkspaceAgentLogSourceExternal

+ const WorkspaceAgentLogSourceKubernetesLogs

+ const WorkspaceAgentLogSourceShutdownScript

+ const WorkspaceAgentLogSourceStartupScript

+ func AllWorkspaceAgentLogSourceValues() []WorkspaceAgentLogSource

+ func (e *WorkspaceAgentLogSource) Scan(src interface{}) error

+ func (e WorkspaceAgentLogSource) Valid() bool

+ type WorkspaceAgentMetadatum struct

+ CollectedAt time.Time

+ DisplayName string

+ Error string

+ Interval int64

+ Key string

+ Script string

+ Timeout int64

+ Value string

+ WorkspaceAgentID uuid.UUID

+ type WorkspaceAgentStat struct

+ AgentID uuid.UUID

+ ConnectionCount int64

+ ConnectionMedianLatencyMS float64

+ ConnectionsByProto json.RawMessage

+ CreatedAt time.Time

+ ID uuid.UUID

+ RxBytes int64

+ RxPackets int64

+ SessionCountJetBrains int64

+ SessionCountReconnectingPTY int64

+ SessionCountSSH int64

+ SessionCountVSCode int64

+ TemplateID uuid.UUID

+ TxBytes int64

+ TxPackets int64

+ UserID uuid.UUID

+ WorkspaceID uuid.UUID

+ type WorkspaceAgentStatus string

+ const WorkspaceAgentStatusConnected

+ const WorkspaceAgentStatusConnecting

+ const WorkspaceAgentStatusDisconnected

+ const WorkspaceAgentStatusTimeout

+ func (s WorkspaceAgentStatus) Valid() bool

+ type WorkspaceAgentSubsystem string

+ const WorkspaceAgentSubsystemEnvbox

+ const WorkspaceAgentSubsystemEnvbuilder

+ const WorkspaceAgentSubsystemExectrace

+ const WorkspaceAgentSubsystemNone

+ func AllWorkspaceAgentSubsystemValues() []WorkspaceAgentSubsystem

+ func (e *WorkspaceAgentSubsystem) Scan(src interface{}) error

+ func (e WorkspaceAgentSubsystem) Valid() bool

+ type WorkspaceApp struct

+ AgentID uuid.UUID

+ Command sql.NullString

+ CreatedAt time.Time

+ DisplayName string

+ External bool

+ Health WorkspaceAppHealth

+ HealthcheckInterval int32

+ HealthcheckThreshold int32

+ HealthcheckUrl string

+ ID uuid.UUID

+ Icon string

+ SharingLevel AppSharingLevel

+ Slug string

+ Subdomain bool

+ Url sql.NullString

+ type WorkspaceAppHealth string

+ const WorkspaceAppHealthDisabled

+ const WorkspaceAppHealthHealthy

+ const WorkspaceAppHealthInitializing

+ const WorkspaceAppHealthUnhealthy

+ func AllWorkspaceAppHealthValues() []WorkspaceAppHealth

+ func (e *WorkspaceAppHealth) Scan(src interface{}) error

+ func (e WorkspaceAppHealth) Valid() bool

+ type WorkspaceAppStat struct

+ AccessMethod string

+ AgentID uuid.UUID

+ ID int64

+ Requests int32

+ SessionEndedAt time.Time

+ SessionID uuid.UUID

+ SessionStartedAt time.Time

+ SlugOrPort string

+ UserID uuid.UUID

+ WorkspaceID uuid.UUID

+ type WorkspaceBuild struct

+ BuildNumber int32

+ CreatedAt time.Time

+ DailyCost int32

+ Deadline time.Time

+ ID uuid.UUID

+ InitiatorByAvatarUrl sql.NullString

+ InitiatorByUsername string

+ InitiatorID uuid.UUID

+ JobID uuid.UUID

+ MaxDeadline time.Time

+ ProvisionerState []byte

+ Reason BuildReason

+ TemplateVersionID uuid.UUID

+ Transition WorkspaceTransition

+ UpdatedAt time.Time

+ WorkspaceID uuid.UUID

+ type WorkspaceBuildParameter struct

+ Name string

+ Value string

+ WorkspaceBuildID uuid.UUID

+ type WorkspaceBuildTable struct

+ BuildNumber int32

+ CreatedAt time.Time

+ DailyCost int32

+ Deadline time.Time

+ ID uuid.UUID

+ InitiatorID uuid.UUID

+ JobID uuid.UUID

+ MaxDeadline time.Time

+ ProvisionerState []byte

+ Reason BuildReason

+ TemplateVersionID uuid.UUID

+ Transition WorkspaceTransition

+ UpdatedAt time.Time

+ WorkspaceID uuid.UUID

+ type WorkspaceProxy struct

+ CreatedAt time.Time

+ Deleted bool

+ DerpEnabled bool

+ DerpOnly bool

+ DisplayName string

+ ID uuid.UUID

+ Icon string

+ Name string

+ RegionID int32

+ TokenHashedSecret []byte

+ UpdatedAt time.Time

+ Url string

+ WildcardHostname string

+ func (w WorkspaceProxy) IsPrimary() bool

+ func (w WorkspaceProxy) RBACObject() rbac.Object

+ type WorkspaceResource struct

+ CreatedAt time.Time

+ DailyCost int32

+ Hide bool

+ ID uuid.UUID

+ Icon string

+ InstanceType sql.NullString

+ JobID uuid.UUID

+ Name string

+ Transition WorkspaceTransition

+ Type string

+ type WorkspaceResourceMetadatum struct

+ ID int64

+ Key string

+ Sensitive bool

+ Value sql.NullString

+ WorkspaceResourceID uuid.UUID

+ type WorkspaceStatus string

+ const WorkspaceStatusCanceled

+ const WorkspaceStatusCanceling

+ const WorkspaceStatusDeleted

+ const WorkspaceStatusDeleting

+ const WorkspaceStatusFailed

+ const WorkspaceStatusPending

+ const WorkspaceStatusRunning

+ const WorkspaceStatusStarting

+ const WorkspaceStatusStopped

+ const WorkspaceStatusStopping

+ func (s WorkspaceStatus) Valid() bool

+ type WorkspaceTransition string

+ const WorkspaceTransitionDelete

+ const WorkspaceTransitionStart

+ const WorkspaceTransitionStop

+ func AllWorkspaceTransitionValues() []WorkspaceTransition

+ func (e *WorkspaceTransition) Scan(src interface{}) error

+ func (e WorkspaceTransition) Valid() bool