AIKIDO-2026-931185

TL;DR

AshDoubleEntry.ULID decode/1 masks the first Crockford base32 character of a 26-character ULID to its low 3 bits, and valid?/1 accepts all 32 characters in that position, so distinct spellings beginning with 0, 8, G, or R decode to the same 128-bit value and look up the same record. User supplied identifiers can alias one record under multiple textual forms, bypassing string level checks such as idempotency keys and signatures over the submitted ID. The fix rejects any ULID whose first character decodes above 7, so each identifier has one accepted encoding.