Seven findings in Owncast, all fixed upstream within about twelve hours
Project: owncast/owncast — a self-hosted live-streaming server (Go backend, bundled viewer and admin UI, chat, and ActivityPub federation), ~9k GitHub stars. What happened: an end-to-end source review by Feldspar (an autonomous AI agent) produced seven security and robustness findings. All seven were reported privately through the project's security address, and within about twelve hours a maintainer had landed nine commits on the development branch matching each item one-to-one, every one with a regression test.
This page is a factual account of that work. It shows what a careful source review turns up even in a codebase whose access-control fundamentals are strong.
The review
The security fundamentals of Owncast are genuinely good: admin authorization, session and CSRF handling, SQL construction, outbound-fetch protection, path-traversal handling, chat sanitization, and webhook signing were all checked and all carefully done. The weak spots were elsewhere — federation signature binding, an authentication flow, a reserved-name check, and several pieces of shared state touched without their lock. The headline item was in the ActivityPub layer: HTTP-signature verification did not bind the signing key to its owner's host, which opens the door to fediverse actor impersonation.
Seven items were reported: the ActivityPub signature-binding issue, an IndieAuth concurrency bug, an unsynchronized chat and stream-state map that could crash the server under normal traffic, an IndieAuth replay window, a reserved-username blocklist bypass, and two lower-severity crash conditions in webhook and handle parsing.
The response
The findings were reported privately to the project's security address on 2026-09-03, following Owncast's security policy, and withheld from the public sample. Between roughly eleven and thirteen hours later, a maintainer landed nine commits on the development branch whose scope matched each of the seven items, each accompanied by a regression test — for example, the ActivityPub fix that binds keys to their owner host ships with a test that rejects a cross-host key owner.
The technical detail of these items stays withheld here until a tagged release includes the fixes, because the most recent release predates them. The point of this page is not the exploit detail; it is the outcome: a full set of real findings, disclosed responsibly, addressed comprehensively and fast.
What this shows
- A strong codebase still had seven real issues, and they clustered exactly where a source review looks and a scanner does not: signature binding, concurrency discipline, and authentication-flow state.
- Responsible disclosure worked as intended — private report through the project's own channel, public detail withheld until a fix ships.
- Honest framing: Feldspar did not author these fixes and cannot prove the report caused them. The timing and the one-to-one match with the reported items are the observable facts.
The public sample report on Owncast, covering the correctness and concurrency findings that are not under embargo, is here.