Issues

• OID4VP: error responses are not JARM-encoded for response_mode=direct_post.jwt

  sirosfoundation/go-wallet-backend#441 · Filter by author leifj opened on Oct 6, 2026

• Token Status List check for mdoc credentials on presentation

  sirosfoundation/go-wallet-backend#435 · Filter by author leifj opened on Oct 6, 2026

• Verify the OIDC gate middleware uses the SSRF-guarded HTTP client

  security
  sirosfoundation/go-wallet-backend#434 · Filter by author leifj opened on Oct 6, 2026

• WMP: share session routing and replay state across engine replicas (follow-up to #163)

  sirosfoundation/go-wallet-backend#432 · Filter by author leifj opened on Oct 1, 2026

• wallet-admin sync cannot clear required_claims (removed from YAML, stays on server, never converges)

  sirosfoundation/go-wallet-backend#426 · Filter by author leifj opened on Sep 29, 2026

• TokenBlacklist (jti/user/family revocation) is process-local, not shared across replicas or restarts

  security
  sirosfoundation/go-wallet-backend#415 · Filter by author leifj opened on Sep 29, 2026
  2

• Stage fetching of issuer metadata for increased compatibility

  sirosfoundation/go-wallet-backend#371 · Filter by author s-jairl opened on Sep 28, 2026
  2

• Per-instance revocation should delete the linked passkey, with the login gate as backstop

  security
  sirosfoundation/go-wallet-backend#361 · Filter by author leifj opened on Sep 22, 2026

• Refresh tokens are not individually revocable, so killing a session leaves one working for a week

  security
  sirosfoundation/go-wallet-backend#360 · Filter by author leifj opened on Sep 22, 2026
  3

• Token gate passes a token naming a deleted user, so account removal leaves working bearer tokens

  security
  sirosfoundation/go-wallet-backend#354 · Filter by author leifj opened on Sep 18, 2026

• Lifecycle: an in-flight request can write wallet data back after the erasure completed

  security
  sirosfoundation/go-wallet-backend#353 · Filter by author leifj opened on Sep 18, 2026

• SID-AUTH-06: a user has no way to request revocation of their wallet (Art. 5a(9)(a), WURevocation_10, WIAM_06)

  conformance
  sirosfoundation/go-wallet-backend#352 · Filter by author leifj opened on Sep 18, 2026
  2

• Carry wallet-instance identity past login (prerequisite for per-instance lifecycle semantics)

  conformance
  sirosfoundation/go-wallet-backend#342 · Filter by author leifj opened on Sep 18, 2026
  2

• Lifecycle gate: tokens carry too little identity to bind a passkey or reach anonymous tokens

  security
  sirosfoundation/go-wallet-backend#333 · Filter by author leifj opened on Sep 17, 2026
  2

• Lifecycle: concurrent lifecycle events across tenants / during attestation can leave a deactivated wallet's data unerased until the next revoke-all

  security
  sirosfoundation/go-wallet-backend#330 · Filter by author leifj opened on Sep 15, 2026
  5

• mongodb: Ensure data consistency for critical read/writes

  sirosfoundation/go-wallet-backend#257 · Filter by author s-jairl opened on Aug 4, 2026

• Support client_secret for confidential IdPs (e.g. Google) in the AS OIDC login and the OIDC gate

  sirosfoundation/go-wallet-backend#227 · Filter by author Didr opened on Jun 25, 2026
  4

• feat: implement tenant statistics with dedicated counters

  enhancement
  sirosfoundation/go-wallet-backend#223 · Filter by author leifj opened on Jun 20, 2026

• feat: add SET tamper-evident audit logging

  audit
  sirosfoundation/go-wallet-backend#222 · Filter by author leifj opened on Jun 19, 2026
  3

• feat: Cross-platform credential lifecycle notifications (push/re-issue/revoke)

  enhancement
  sirosfoundation/go-wallet-backend#218 · Filter by author leifj opened on Jun 16, 2026

• feat: Wallet instance lifecycle management (SID-AUTH-06)

  conformance
  sirosfoundation/go-wallet-backend#195 · Filter by author leifj opened on Jun 3, 2026 · R4 (BETA)
  5

  

• Integrate Token Status List verification for credential presentations

  sirosfoundation/go-wallet-backend#192 · Filter by author leifj opened on Jun 2, 2026
  1

• Add structured audit logging for admin API mutations

  audit
  sirosfoundation/go-wallet-backend#190 · Filter by author leifj opened on Jun 2, 2026
  3

  

• Issuer discovery: tenant-scoped issuer catalog (slice 1 of rescoped plan)

  sirosfoundation/go-wallet-backend#124 · Filter by author leifj opened on Apr 22, 2026
  1

• Session JWTs: finish HMAC -> ES256 migration; HSM key for the AS (rescoped; CA/rotation is operational)

  enhancement
  sirosfoundation/go-wallet-backend#100 · Filter by author leifj opened on Apr 14, 2026 · R4 (BETA)
  4