Problemsby GlyphPermissions and IAM are confusing and error-prone
27 posts from 27 people24d activeRising, +2 this week
Posts per day
The posts behind it
Explore bootstrap ignores dashboard RBAC: /api/v1/explore/ returns 403 for dashboard-role users without dataset permission
### Bug description A user who has access to a dashboard **only through dashboard roles** (DASHBOARD_RBAC enabled, dashboard has roles assigned) but has **no dataset permission** cannot open a chart in Explore. - Superset 4.0.2: the Explore page loads the chart normally; the...
Security/Privacy: Chat implicit active-editor context automatically transmits .env secrets to LLM without consent or sensitive-file filtering
### Summary When sending a message in the Chat view (e.g., in Ask mode with Default Permissions enabled), VS Code automatically attaches the full contents of the currently active editor tab as ` ` in the prompt payload. There is no default exclusion list for sensitive files...
[Bug] Sandbox fails on Ubuntu 26.04: AppArmor bwrap-userns-restrict profile denies CAP_SYS_ADMIN
...and runs bwrap's child processes under "unpriv_bwrap", which denies all capabilities. Workaround: disable bwrap-userns-restrict and reload the docs profile. Request: update the docs for 26.04, or make the sandbox work with the stricter default profile. **Environment Info** -...
[BUG] macOS 27: background sessions read Chrome/Brave/Edge data folders at startup, raising a sticky "Data Access Blocked" alert from an app named only "2.1.310"
### Preflight Checklist - [x] I have searched existing issues and this hasn't been reported yet - [x] This is a single bug report (please file separate reports for different bugs) - [x] I am using the latest version of Claude Code ### What's Wrong? On macOS 27, Claude Code...
RBAC-only with a non-empty scope for the MCP server
### Bug description Hello, I Have set up RBAC for the MCP server, but I get errors on tools which declare no permissions (attached bellow). I understand the problem comes from my Identity provider which does not accept an empty scope and that a token with a non-empty scope...
Service account keeps getting locked out - only on one node of an HA pair (Event 4771)
Hey everyone,. I'm dealing with a frustrating issue and hoping someone here has seen it before.. Setup: . 2-node HA environment running ManageEngine ServiceDesk Plus. A dedicated service account for the app. The problem: The service account gets locked out periodically , and I...
issue: "Allow Chat Edit" off does not stop users from editing their own messages
...already decides who can edit prompts. So an admin who turns it off expects users to be unable to edit any message. **Expected Behavior** With "Allow Chat Edit" off, the user's own messages have no Edit button either. **Actual Behavior** The user message shows Edit. Save stores...
[Feature]: Advanced Admin User Management & Family Access
### Are you willing to submit a PR? Yes, I'd like to submit a PR! ### What problem does this solve? I'm currently self-hosting SparkyFitness v1.8.0 on Proxmox for personal and family use. While the existing Admin → User Management section provides basic account administration, I...
Kosty 3.6: my open source AWS audit CLI is now plugin-based, with Bedrock & SageMaker audits, IAM privilege escalation detection and attack surface mapping
...adding a single service meant touching the core in three or four places. It was getting painful even for me. Since 3.0 every service is its own plugin with its own checks and the CLI just picks them up. If you want to add a check you don't need to understand the whole codebase...
I built a self-hosted data platform for small to mid workloads (similar to Microsoft Fabric)
...open sources tools usually comes with maintenance, networking and configuration headache, also these tools aren't unified under one control plane and don't know that other tools exists.. so I built a data platform that can be deployed on a single machine or server, and since I'm...
[Feature] info schema: expose raw_code on the models view for checks
...are disabled by configuration`. The sandbox makes sense, but it removes the only workaround. Our use case: table and incremental models must select two audit columns (`_git_hash_`, `_transformed_at_`). The same gap blocks rules like banned functions, hardcoded relation names, or...
Lambda, ECR, Glacier and OpenSearch public access fixers delete the whole resource policy
### Which component is affected? Prowler CLI/SDK ### Cloud Provider AWS ### Steps to Reproduce 1. Give a resource a policy with one public statement plus statements that are not public. For example, an ECR repository with: - `Public`: `Allow` `ecr:*` to `{"AWS": "*"}` (the...
[New Check]: Vertex AI Workbench terminal, download and auto-upgrade checks with CCC MLDE mapping
### Feature search - [x] I have searched the existing issues and this feature has not been requested yet or is already in our [Public Roadmap](https://roadmap.prowler.com/roadmap) ### Which component would this feature affect? Prowler CLI/SDK ### Related to specific cloud...
Microsoft Teams: Automations trigger not firing on new message in channel
In cursor:web Automations, I am unable to trigger a cursor automation from the Microsoft teams integration: New Message in Teams channel. Debugging steps: attempted running as service account and myself switched from…
AI Agents Linked to Tencent Cloud Probed Alibaba's Amap, Researchers Say
...between their initialization and their first outbound request. The target service had no way to distinguish a legitimate automated caller from an adversarial one before the probe landed.. For those running production APIs or services that autonomous agents - not humans, not...
How to transfer the pay-as-you-go subscription to another account?
...ownership so they can download invoices and tax documents and do other administration. How can I do it, without interruption?.
Connecting Infoblox to AD
...and having some trouble. The logs give very little information and the documentation sucks. I am working with support but they seem to be struggling. I have both LDAP and LDAPSs configured but won't let me log in. Yes I did create the groups called admin-group and add myself and...
Users Can't Access SQL Endpoint Without Workspace Access
...to give users access to the SQL endpoint of our newest lakehouse, but we're running into issues with permissions. When they connect through the Onelake Catalog menu in Power BI, they're able to connect with no problems. But if they try to use the actual endpoint string, either...
feat: Add Cloudflare Web Search API (AI Gateway) as a Web Search Provider
### Before Submitting - [x] I searched open and closed issues and discussions for an existing request. - [x] I checked whether this already exists on the `dev` branch or latest source. - [x] I understand that maintainers want a well-written issue or discussion before any code...
I built a browser-based Azure architecture tool-and Azure has been helping me find the edge cases
...and multiple subscriptions are supported, so landing‑zone‑style hierarchies aren't stuck with a single default sub. ( u/szescio .) . Azure Front Door is in. ( u/Jazzlike _Rice_8784 - fixed, by the way.) . VM SKUs are no longer a short hard‑coded list you have to fight - you can...
RBAC Challenges
...some growth, internal restructuring and wider IT transformation, and it has exposed a lack of proper role-based access controls for new joiners and internal transfers.. Historically, we relied upon ‘user to copy’ in the new user request, and leveraging automation in our ITSM...
CouchbaseFTSVectorSearchTool reports any cluster error as a missing bucket
### Description `CouchbaseFTSVectorSearchTool._check_bucket_exists` catches every exception from the cluster and returns `False`: The caller turns that `False` into a specific claim: So a timeout, an authentication failure, a permissions error or an unreachable node all report...
Configuration management
...some Secrets too); - Infisical: it is very expensive and I have just found that you can't get a Pro licence for a self-hosted instance, but you have to go directly to Enterprise, or use their Cloud solution (and I don't find too safe to write my sensitive information in a Cloud...
Allow List vs Deny List for ACLs
### Describe the current behavior After talking this through with Marvin (https://prefect-community.slack.com/archives/C04DZJC94DC/p1788888525925399), my understanding of RBAC and ACLs in prefect is that basically entities (Users, Teams, Service Accounts) can be given roles,...
How do you provision RDS & DocumentDB users cleanly? Dual Terraform + Pulumi setup feels redundant.
Hi everyone, looking for a sanity check and some advice on DB user management.. Context & Current Setup: . Team: ~10 developers.. Infra: Everything is provisioned with Terraform.. The Catch: Pulumi is used exclusively to connect through a bastion host to create users in RDS...
scan_iceberg ignores catalog-vended credentials on the pyiceberg Table's FileIO
...This bypasses the intended catalog RBAC + vended credential mechanism. Current Workaround: Request: When source is a pyiceberg Table and storage_options is None, derive them from `table.io.properties` Verified on 1.43.2.
...The list goes on. None of those friction points apply to hobby hosting, really. IAM is annoying because the alternative isn’t “fill out 7 forms and host 12 meetings to get a new vendor in”. You also get less of the benefits. Low volume SQS can be trivially replaced, but if you...
Companies and products named
About this problem
Evidence
27 posts from 27 people in 19 places, about 3 a week over 60 days. Mostly on r/sysadmin, r/devops, r/AZURE. Tools named alongside: AWS, GitHub, Microsoft Azure, Microsoft Fabric.
Frustration Frustration 0 of 3· Seen on GitHub issues, Reddit, Hacker News, Community forums
How it was grouped
Posts that state a pain and match the "permissions" rule. First post Sep 6, 2026, latest Nov 4, 2026. Corroborated: 3 or more posts from 2 or more people or places. Method
The same problem elsewhere
AWS permissions are confusing and error-prone
11 posts from 11 people on Reddit, GitHub issues, Hacker News.
Kubernetes permissions are confusing and error-prone
9 posts from 5 people on Mastodon, Bluesky, Reddit.
PostgreSQL permissions are confusing and error-prone
7 posts from 7 people on GitHub issues, Hacker News.
Docker permissions are confusing and error-prone
6 posts from 6 people on GitHub issues, Stack Overflow.
GitHub permissions are confusing and error-prone
4 posts from 4 people on GitHub issues, Reddit.
DuckDB permissions are confusing and error-prone
3 posts from 3 people on GitHub issues.
MLflow permissions are confusing and error-prone
3 posts from 3 people on GitHub issues.
ChatGPT permissions are confusing and error-prone
3 posts from 3 people on GitHub issues, Reddit.
Snowflake permissions are confusing and error-prone
3 posts from 3 people on Reddit, GitHub issues.
Gemini permissions are confusing and error-prone
3 posts from 3 people on Community forums, GitHub issues.
Codex permissions are confusing and error-prone
2 posts from 2 people on GitHub issues. Unverified.
Oracle permissions are confusing and error-prone
2 posts from 2 people on Community forums, Reddit. Unverified.
History