Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
afx-team/petercat
main @ 87be0b8
21
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 16 prior fixes. Scrutinize any change in this area.
server/auth/get_user_info.py: most-fixed (4 issues). Treat as high-risk during review.
14 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The application historically suffered from critical session-handling bugs where security cookies were set on temporary objects and discarded during redirects, alongside fragile token logic. Developers must avoid manual cookie state tracking and use robust, verified session libraries.
Auth Bypass: Unauthenticated clients could bypass access controls and interact with privileged bot builders because endpoints trusted client-supplied user ID cookies rather than validating a cryptographically secure token.
Auth Bypass: The global authentication middleware suffered from severe design flaws, including a complete bypass in development mode, insecure validation using the client 'Referer' header, and over-permissive anonymous allowlists.