Issues

• oauthlib 4.0.0 is an unevaluated major already inside our resolution set

  CloudSecurityAlliance/csa-google-workspace#518 · Filter by author kurtseifried opened on Oct 4, 2026

• whoami returns a bare "Error executing tool whoami" — three tool modules never pass through _errors, and _untrusted.py says every tool does

  CloudSecurityAlliance/csa-google-workspace#516 · Filter by author kurtseifried opened on Oct 3, 2026

• The register does not say which document it is about — no URL, no path, no name in the rows

  CloudSecurityAlliance/csa-google-workspace#505 · Filter by author kurtseifried opened on Sep 29, 2026

• A register cannot be created beside its document, and the export has no author email — the two ends of a comment workflow

  CloudSecurityAlliance/csa-google-workspace#504 · Filter by author kurtseifried opened on Sep 29, 2026

• report_a_problem tells the model what to do and tells the user nothing — the payload has no next steps

  CloudSecurityAlliance/csa-google-workspace#503 · Filter by author kurtseifried opened on Sep 29, 2026

• An exported register hides the context columns entirely and calls four different things "reply"

  CloudSecurityAlliance/csa-google-workspace#502 · Filter by author kurtseifried opened on Sep 29, 2026

• export_comments writes to disk and to Drive outside the scrub boundary — and a written register carries no untrusted marking

  CloudSecurityAlliance/csa-google-workspace#501 · Filter by author kurtseifried opened on Sep 29, 2026

• context_kind "nearest_text" is documented to consumers and cannot be produced

  CloudSecurityAlliance/csa-google-workspace#492 · Filter by author kurtseifried opened on Sep 28, 2026

• copy_file creates a Drive file but is checked against the READ allowlist

  CloudSecurityAlliance/csa-google-workspace#491 · Filter by author kurtseifried opened on Sep 28, 2026

• auth_status reports a working default-install credential as "not usable"

  CloudSecurityAlliance/csa-google-workspace#490 · Filter by author kurtseifried opened on Sep 28, 2026

• auth_status: a write token refused by a read-only posture reports as no_credential

  CloudSecurityAlliance/csa-google-workspace#488 · Filter by author kurtseifried opened on Sep 28, 2026

• The audit-index guard passed a full-suite run while the committed index was stale

  bug
  CloudSecurityAlliance/csa-google-workspace#483 · Filter by author kurtseifried opened on Sep 27, 2026
  3

• [0.52.0] list_comments/export_comments drop the comment author's email, making authorship unresolvable to a person

  assisted-report
  CloudSecurityAlliance/csa-google-workspace#476 · Filter by author kurtseifried opened on Sep 21, 2026

• Decide: should Dependabot watch the pip ecosystem at all? Two unsatisfiable PRs in one day

  lockfile
  CloudSecurityAlliance/csa-google-workspace#471 · Filter by author kurtseifried opened on Sep 16, 2026
  5

• Handoff 2026-09-16: state after the Windows work and v0.53.0, and what a different machine needs

  CloudSecurityAlliance/csa-google-workspace#470 · Filter by author kurtseifried opened on Sep 16, 2026
  1

• The macOS rig should match the Windows one — starting with the fact that its log is not safe to hand over

  CloudSecurityAlliance/csa-google-workspace#463 · Filter by author kurtseifried opened on Sep 16, 2026

• [security] T5's mitigation evidence was POSIX-only: three named mechanisms were no-ops on Windows

  security
  CloudSecurityAlliance/csa-google-workspace#452 · Filter by author kurtseifried opened on Sep 15, 2026
  2

• Slides anchors are resolvable and we throw them away — a speaker-notes comment reports as a slide comment

  CloudSecurityAlliance/csa-google-workspace#427 · Filter by author kurtseifried opened on Sep 5, 2026
  1

• Drive v3 has an approvals resource — a native document-approval workflow nothing here mentions

  CloudSecurityAlliance/csa-google-workspace#413 · Filter by author kurtseifried opened on Sep 3, 2026
  2

• Does a Drive-API comment notify anybody? Unknown, and both answers are operationally serious

  CloudSecurityAlliance/csa-google-workspace#399 · Filter by author kurtseifried opened on Sep 3, 2026
  1

• Read a past revision: Drive keeps the history our provenance record needs, and nothing here reaches it

  CloudSecurityAlliance/csa-google-workspace#389 · Filter by author kurtseifried opened on Sep 3, 2026
  1

• A PUBLIC Drive "zoo" of reference files — official corpus, regression canary, and the fixture set for the native APIs

  CloudSecurityAlliance/csa-google-workspace#388 · Filter by author kurtseifried opened on Sep 3, 2026
  1

• The Docs API now has comments AND suggestion accept/reject — in Developer Preview, and it obsoletes two of our 'API-impossible' claims

  enhancementsecurity
  CloudSecurityAlliance/csa-google-workspace#364 · Filter by author kurtseifried opened on Sep 2, 2026
  3

• Anchors are a localization hint, not ground truth: surrounding context, structural path, and notes

  CloudSecurityAlliance/csa-google-workspace#358 · Filter by author kurtseifried opened on Sep 2, 2026
  2

• Document why comments are harder than they look — people don't trust this works because their own build failed

  documentation
  CloudSecurityAlliance/csa-google-workspace#340 · Filter by author kurtseifried opened on Sep 1, 2026
  3