Issues

• SSRF via submissionApiUrl config field — attacker receives M2M bearer token on scoring callbacks

  Rejected - Not reproduced
  topcoder-platform/marathon-match-api-v6#50 · Filter by author FedorPortnoi opened on May 28, 2026

• Leaderboard isn't sorted

  Accepted
  topcoder-platform/marathon-match-api-v6#49 · Filter by author eulerscheZahl opened on May 28, 2026

• normalizeTestPhase(undefined) silently defaults to 'provisional' — EXAMPLE and SYSTEM score rows with missing metadata incorrectly counted as provisional

  Rejected - Not a bug
  topcoder-platform/marathon-match-api-v6#48 · Filter by author FedorPortnoi opened on May 28, 2026

• rerunLatestSubmissions() always dispatches PROVISIONAL scoring regardless of the currently open phase

  Accepted
  topcoder-platform/marathon-match-api-v6#47 · Filter by author FedorPortnoi opened on May 28, 2026

• MINIMIZE scoring: error/default score of 0 treated as the best possible score, collapsing all valid scores to zero relative credit

  Accepted
  topcoder-platform/marathon-match-api-v6#46 · Filter by author FedorPortnoi opened on May 28, 2026

• Per-test-case timeout uses process.destroy() (SIGTERM) — submission process can catch the signal and run beyond the time limit

  Accepted
  topcoder-platform/marathon-match-api-v6#45 · Filter by author FedorPortnoi opened on May 28, 2026

• No deduplication on Kafka consumer — duplicate message delivery launches two ECS scorer tasks for the same submission

  Rejected - Not a bug
  topcoder-platform/marathon-match-api-v6#44 · Filter by author FedorPortnoi opened on May 28, 2026

• updateSubmissionStatus() is a no-op mock — submission processing status never updated in Submission API

  Rejected - Not a bug
  topcoder-platform/marathon-match-api-v6#43 · Filter by author FedorPortnoi opened on May 28, 2026

• ScorerMain unconditionally dumps all environment variables to stdout — ACCESS_TOKEN and seeds exposed in every run

  Rejected - Duplicate
  topcoder-platform/marathon-match-api-v6#42 · Filter by author FedorPortnoi opened on May 28, 2026

• Seccomp filter only blocks socket() — ptrace, process_vm_readv, perf_event_open not blocked; user code can read tester JVM memory

  Rejected - Duplicate
  topcoder-platform/marathon-match-api-v6#41 · Filter by author FedorPortnoi opened on May 28, 2026

• RUNNER_ISOLATED_EXECUTION=1 env var set by isolation wrapper allows submissions to detect the judging environment

  Rejected - Not a bug
  topcoder-platform/marathon-match-api-v6#40 · Filter by author FedorPortnoi opened on May 28, 2026

• Auto-generated .csproj for C# submissions includes <AllowUnsafeBlocks>true</AllowUnsafeBlocks>

  Rejected - Duplicate
  topcoder-platform/marathon-match-api-v6#39 · Filter by author FedorPortnoi opened on May 28, 2026
  1

• CORS origin uses unanchored regex with credentials: true — attacker subdomain bypasses same-origin restriction

  Accepted
  topcoder-platform/marathon-match-api-v6#38 · Filter by author FedorPortnoi opened on May 28, 2026

• JWT aud (audience) claim never validated — tokens issued for other Topcoder services accepted

  Rejected - Not a bug
  topcoder-platform/marathon-match-api-v6#37 · Filter by author FedorPortnoi opened on May 28, 2026

• isAdmin() unconditionally treats every M2M token as administrator — full authorization bypass

  Rejected - Not a bug
  topcoder-platform/marathon-match-api-v6#36 · Filter by author FedorPortnoi opened on May 28, 2026

• User statistics have broken link

  Accepted
  topcoder-platform/marathon-match-api-v6#35 · Filter by author eulerscheZahl opened on May 28, 2026

• User statistics show wrong ranks

  Accepted
  topcoder-platform/marathon-match-api-v6#34 · Filter by author eulerscheZahl opened on May 28, 2026

• User ratings are outdated

  Accepted
  topcoder-platform/marathon-match-api-v6#33 · Filter by author eulerscheZahl opened on May 28, 2026
  2

• Failed submission while still in progress; submission time changes

  Accepted
  topcoder-platform/marathon-match-api-v6#32 · Filter by author eulerscheZahl opened on May 28, 2026
  1

  

• Authorization Bypass in TokenRolesGuard Allows Scope-Only Access to Internal Scoring APIs

  Rejected - Not a bug
  topcoder-platform/marathon-match-api-v6#30 · Filter by author ShadowGodTT opened on May 28, 2026

• Authorization Bypass in TokenRolesGuard Allows Scope-Only Access to Internal Scoring APIs

  Rejected - Not a bug
  topcoder-platform/marathon-match-api-v6#29 · Filter by author ShadowGodTT opened on May 28, 2026

• Authorization Bypass in TokenRolesGuard Allows Scope-Only Access to Admin Scoring Endpoints

  Rejected - Not a bug
  topcoder-platform/marathon-match-api-v6#28 · Filter by author ShadowGodTT opened on May 28, 2026

• [Security] Active TCP connections to ECS metadata endpoint (169.254.170.2) and external services visible via /proc/net/tcp

  Rejected - Duplicate
  topcoder-platform/marathon-match-api-v6#27 · Filter by author tsiwt opened on May 28, 2026

• [Security] Runner application JAR (/app/mm-ecs-runner.jar) is readable by submitted code

  Rejected - Duplicate
  topcoder-platform/marathon-match-api-v6#26 · Filter by author tsiwt opened on May 28, 2026

• [Security] Submitted code can execute arbitrary shell commands via subprocess/os.system

  Rejected - Duplicate
  topcoder-platform/marathon-match-api-v6#25 · Filter by author tsiwt opened on May 28, 2026