Dashboard › publish › Distillation
34d3a035-d24b-4590-89f9-44aba99605da["lore_tm_v1_-ZeWEd7kQYpj8igRRBT4fHVe41NmEAf52fO15WOZSeM","lore_tm_v1_3YwjIwzPhy3xeX24EeDFjWs3Qe-xUvNtL_hLc1iIqI8"]
Date: Aug 27, 2026
src/modules/approval-authorizer.js:5-24 has no separation-of-duties check; a release requester with write, maintain, or admin access can add accepted to their own release issue and pass authorization. The workflow does not supply requester identity, preventing enforcement of the required second-person approval; no regression test covers self-approval.src/modules/approval-authorizer.js:14-16 lets getsantry[bot] bypass all target-repository authorization. The acceptance gate does not verify the label originated from the allowlisted auto-approval path, so any accepted label event by that bot authorizes any getsentry release; this also violates the second-person requirement.src/modules/approval-authorizer.js:3,8 rejects release titles without an explicit getsentry/ owner, whereas src/modules/details-from-context.js:24-25 accepts them. Supported titles such as publish: sentry@21.3.1 would have accepted removed; no test covers this title form.