RagLeapThis page lists known security issues in RagLeap Core, written from the project’s release notes, and says how to report one. RagLeap Core has not had an independent security review.
Reporting a problem
Read the SECURITY.md of ragleap-core and follow it.
Voice channel accepted every connection (fixed in v0.12.1, 2026-11-02)
- What: the voice channel’s WebSocket server accepted every connection, and the Twilio setup needs it reachable from the internet. Advisory GHSA-fg9g-772q-rr9c is published on GitHub (updated 2026-11-09: this said it was named in the release notes).
- Affected: v0.1.0 to v0.12.0, for installs that expose the voice port.
- Fixed in: v0.12.1. A call is accepted only when the address it connects to ends in a secret (
VOICE_WS_TOKEN); a missing or wrong token gets HTTP 401. - What to do: put a long random value in
.envasVOICE_WS_TOKEN, change the Twilio stream address to end in it (usewss), then rebuild and restart the voice service.
Details: the v0.12.1 post and the release notes.