Issues

• Match index (Bloom filter) leaks token frequency at rest — investigate searchable symmetric encryption (SSE) as an alternative

  enhancementneeds-triageSDK
  cipherstash/stack#1326 · Filter by author coderdan opened on Oct 21, 2026

• json_tree: the smaller performance findings from the first benchmarks

  enhancementSDK
  cipherstash/stack#1324 · Filter by author coderdan opened on Oct 21, 2026

• stack-encrypt: a typed equality query on text that cannot be normalized is refused only after the keyset is resolved — refuse it first, as the Go binding does

  enhancementready-for-agentSDK
  cipherstash/stack#1321 · Filter by author tobyhede opened on Oct 21, 2026

• stack-encrypt: one inverted-range rule for between on the typed chain and the binding

  enhancementready-for-agentSDK
  cipherstash/stack#1320 · Filter by author tobyhede opened on Oct 21, 2026

• stack-encrypt: one match query preparation for the typed chain and the binding, and no query flag in term derivation

  enhancementready-for-agentSDK
  cipherstash/stack#1319 · Filter by author tobyhede opened on Oct 21, 2026

• stack-encrypt: replace Supports::check, verifier and admit with one prepare, called once per query

  enhancementready-for-agentSDK
  cipherstash/stack#1318 · Filter by author tobyhede opened on Oct 21, 2026
  1

• stack-encrypt: pin every query refusal across the typed chain and the binding in one table test

  enhancementready-for-agentSDK
  cipherstash/stack#1317 · Filter by author tobyhede opened on Oct 21, 2026

• EQL: user-facing docs in packages/eql/docs duplicate the docs repo and are stale (v3 only)

  SDK
  cipherstash/stack#1316 · Filter by author coderdan opened on Oct 21, 2026
  

• EQL: version() reports the distributing SDK's version, not EQL's

  SDK
  cipherstash/stack#1315 · Filter by author coderdan opened on Oct 21, 2026
  

• Docs: EQL v4 and Stack Encrypt compatibility policy

  SDK
  cipherstash/stack#1314 · Filter by author coderdan opened on Oct 21, 2026
  

• EQL: introspection function to classify a value

  SDK
  cipherstash/stack#1313 · Filter by author coderdan opened on Oct 21, 2026
  

• Go: service discovery and control-plane client (keysets) on top of auth.Strategy

  SDK
  cipherstash/stack#1312 · Filter by author coderdan opened on Oct 21, 2026
  

• Validate ZeroKMS access tokens against the CTS JWKS before use

  SDK
  cipherstash/stack#1311 · Filter by author coderdan opened on Oct 21, 2026
  

• Go: recover from a closed client (ErrState) after a guest trap or stuck call

  SDK
  cipherstash/stack#1310 · Filter by author coderdan opened on Oct 21, 2026
  

• Match: text shorter than the 3-gram length can't be stored in TextMatch or found by match

  SDK
  cipherstash/stack#1309 · Filter by author coderdan opened on Oct 21, 2026
  1

  

• Go: allow a field identity (context) independent of the column name, and support dual-write columns during index migration

  SDK
  cipherstash/stack#1308 · Filter by author coderdan opened on Oct 21, 2026
  

• Go: public plan-building API for types stashgen can't tag (reconcile with #1116)

  SDK
  cipherstash/stack#1307 · Filter by author coderdan opened on Oct 21, 2026
  

• protect-ffi: apply the eMudhra SPKI blocklist to @cipherstash/stack's HTTP client

  ready-for-humanSDK
  cipherstash/stack#1305 · Filter by author tobyhede opened on Oct 20, 2026

• Rust TLS: block the compromised eMudhra intermediates by SPKI hash in our reqwest/rustls verifier

  ready-for-agentSDK
  cipherstash/stack#1301 · Filter by author tobyhede opened on Oct 20, 2026
  1

• How should I handle one- and two-character substring queries with EQL v4 TextSearch?

  questionSDK
  Feature

  cipherstash/stack#1299 · Filter by author jonathon-walker opened on Oct 20, 2026
  

• Go SDK: stashgen refuses a pointer field such as *encrypt.Date, so an optional value cannot be encrypted

  enhancementSDK
  cipherstash/stack#1298 · Filter by author coderdan opened on Oct 20, 2026
  3

• @cipherstash/migrate database tests never run in CI: no workflow sets PG_TEST_URL

  github-actionsSDK
  cipherstash/stack#1294 · Filter by author tobyhede opened on Oct 20, 2026

• Go SDK rows and queries are never run through EQL in PostgreSQL in CI — add a Go test against the installed EQL v4 bundle

  enhancementready-for-agentSDK
  cipherstash/stack#1289 · Filter by author coderdan opened on Oct 19, 2026 · Golang SDK is available to users

• No SDK can build an EQL v4 range operand for eql_v4.between — range bindings implement no EncryptFrom

  enhancementSDK
  cipherstash/stack#1286 · Filter by author coderdan opened on Oct 19, 2026

• EQL domain CHECKs accept a payload whose version is JSON null ("v": null)

  bugSDK
  cipherstash/stack#1285 · Filter by author coderdan opened on Oct 19, 2026