Issues

• Add advisory ImpactGate reports calibrated against Stack history

  ready-for-agentSDK
  cipherstash/stack#1137 · Filter by author tobyhede opened on Oct 7, 2026

• stashgen refuses the storage-only Text type — it is held back until TextEq is proven end to end

  enhancementrustSDK
  cipherstash/stack#1133 · Filter by author coderdan opened on Oct 7, 2026 · Golang SDK is available to users
  

• stashgen refuses TextOrdOre and TextSearchOre — EQL stores block ORE terms and the engine derives CLLW ORE

  enhancementrustSDK
  cipherstash/stack#1132 · Filter by author coderdan opened on Oct 7, 2026 · Golang SDK is available to users
  

• stashgen refuses TextMatch, TextSearch, TextOrd and TextOrdOpe — the engine derives their terms, but no EQL type is built from them

  enhancementrustSDK
  cipherstash/stack#1131 · Filter by author coderdan opened on Oct 7, 2026 · Golang SDK is available to users
  

• stashgen refuses every number, date and boolean EQL type — the plaintext encoding for non-text families is not specified

  enhancementrustSDK
  cipherstash/stack#1130 · Filter by author coderdan opened on Oct 7, 2026 · Golang SDK is available to users
  

• Go SDK: CI never runs the example program, so it can break unnoticed

  github-actionsSDK
  cipherstash/stack#1124 · Filter by author coderdan opened on Oct 7, 2026

• stack-encrypt: dynamic::record::decrypt returns passthrough fields next to decrypted ones without saying they are not authenticated

  documentationrustSDK
  cipherstash/stack#1121 · Filter by author coderdan opened on Oct 7, 2026
  1

• stack-encrypt: a second .extend() replaces the first, so Rust builds a different context than Go and a query silently misses

  bugrustSDK
  cipherstash/stack#1120 · Filter by author coderdan opened on Oct 7, 2026
  1

• stack-encrypt: no test reads a record written before the dynamic::record lowering — commit a fixture of old rows

  rustSDK
  cipherstash/stack#1119 · Filter by author coderdan opened on Oct 7, 2026
  1

• stack-encrypt: a Rust String field reads a data-plan leaf as "\nalice" — the Rust chain and a data plan seal different leaf bytes

  needs-triagerustSDK
  cipherstash/stack#1118 · Filter by author auxesis opened on Oct 7, 2026

• Go SDK: stashgen -for and policy generation silently drop a foreign type's unexported fields (protobuf unknownFields) and copy no tags

  enhancementSDK
  cipherstash/stack#1117 · Filter by author coderdan opened on Oct 7, 2026

• Go SDK: methods on Cipher and Client take a *record.Plan and their docs and errors say "plan" — rename and hide them

  enhancementSDK
  cipherstash/stack#1116 · Filter by author coderdan opened on Oct 7, 2026

• Go SDK: Decrypt reads some field types through runtime reflection in gensupport — generate the conversions instead

  enhancementSDK
  cipherstash/stack#1115 · Filter by author coderdan opened on Oct 7, 2026

• Go SDK: no test stores a generated type through database/sql, pgx, sqlc or GORM — add a PostgreSQL job

  enhancementSDK
  cipherstash/stack#1114 · Filter by author coderdan opened on Oct 7, 2026

• Go SDK: an opaque struct is sealed as Go-specific JSON that no other SDK is tested against — pin the format or let the engine encode it

  enhancementSDK
  cipherstash/stack#1113 · Filter by author coderdan opened on Oct 7, 2026

• Go SDK: stashgen keeps its own copy of engine rules (index options, index outputs, a second lowering) — ask the engine instead

  enhancementSDK
  cipherstash/stack#1112 · Filter by author coderdan opened on Oct 7, 2026

• Go: errors.As has no target — add a Diagnostic error type that unwraps to today's sentinels

  enhancementSDK
  cipherstash/stack#1101 · Filter by author coderdan opened on Oct 6, 2026 · Golang SDK is available to users

• Go guests return only a status number on failure — add se_last_error carrying the full error as an FfiValue, with a leak test

  enhancementrustSDK
  cipherstash/stack#1100 · Filter by author coderdan opened on Oct 6, 2026 · Golang SDK is available to users

• stack-encrypt, stack-kms and stack-profile errors have no codes or help — add miette path-style codes (stack_encrypt::aead), structured fields, and a rule for what an error may contain

  enhancementrustSDK
  cipherstash/stack#1099 · Filter by author coderdan opened on Oct 6, 2026 · Golang SDK is available to users

• Go errors carry only a status number: give stack-encrypt, stack-kms and stack-auth errors codes, help and fields, and carry them into Go (umbrella)

  enhancementrustSDK
  cipherstash/stack#1098 · Filter by author coderdan opened on Oct 6, 2026 · Golang SDK is available to users

• stack-encrypt: a plan field with an index but no "type" trusts the binding to tag every value the same way — require "type" once the Go binding declares it

  enhancementrustSDK
  cipherstash/stack#1082 · Filter by author coderdan opened on Oct 5, 2026 · Golang SDK is available to users
  1

  

• Upgrading a stack-prisma 1.0 or 1.1 database fails with "out of shared memory" on default Postgres settings

  bugSDK
  cipherstash/stack#1080 · Filter by author auxesis opened on Oct 5, 2026
  1

• stack-encrypt never sends lock context or audit context to ZeroKMS — bind chosen field facts and send audit facts as unverified context

  enhancementrustSDK
  cipherstash/stack#1067 · Filter by author coderdan opened on Oct 4, 2026
  

• @cipherstash/stack runs a second encryption engine (protect-ffi) — new major built on stack-encrypt (umbrella)

  enhancementjavascriptSDK
  cipherstash/stack#1065 · Filter by author coderdan opened on Oct 4, 2026
  

• WebAssembly guest blocks on a synchronous ZeroKMS call and cannot run on the edge — export the two halves of a batch so the host does the I/O

  enhancementrustSDK
  cipherstash/stack#1064 · Filter by author coderdan opened on Oct 4, 2026