<![CDATA[[Aikido][GH#27] Imported handoff can set an attacker-controlled customLocalUrl that Rig opens externally]]>Security finding (Aikido)

Disposition: no remediation (logged).

Labels

security, aikido, no-remediation, severity:low, type:ai_pentest, github-27

Forum tag limit is 5 — full label set listed above and on the matching GitHub issue.

Aikido findings

  • 487885767 — apps/desktop/electron/services/makeProjectWork.js — severity 32 (low)

Tracked in the Rig security log. Posted by Rig for visibility on the Bugs board.

]]>https://community.userig.app/topic/128/aikido-gh-27-imported-handoff-can-set-an-attacker-controlled-customlocalurl-that-rig-opens-externallyRSS for NodeSat, 19 Sep 2026 00:36:48 GMTWed, 12 Aug 2026 18:33:05 GMT60<![CDATA[Reply to [Aikido][GH#27] Imported handoff can set an attacker-controlled customLocalUrl that Rig opens externally on Wed, 12 Aug 2026 21:42:15 GMT]]>Resolved in Mac 1.0.0-beta.55.
GitHub: https://github.com/richharrington20/rig/issues/27
Changelog: https://userig.app/changelog
Bugs hub: https://userig.app/changelog?hub=bugs

]]>https://community.userig.app/post/161https://community.userig.app/post/161Wed, 12 Aug 2026 21:42:15 GMT