Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aipotheosis-labs/aci

              main @ 3e4a82f
            

Fixes

CVEs

CRITICAL

Peak severity

92.3%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

.github/workflows/integration_code_review.yml: most-fixed (2 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: The integration code review workflow interpolated untrusted pull request properties (such as titles or body text) directly into shell commands, risking arbitrary command execution in the runner context. The fix moved these parameters into secure environment variables.

Auth Bypass: Several application routers (/apps, /functions, /projects) were exposed without authentication enforcement because standard API key and Bearer token verification dependencies were not registered at the router inclusion level.

Remote Code Execution: Workflows triggered by the privileged pull_request_target event allowed unauthorized fork PRs to execute arbitrary code and potentially exfiltrate repository secrets, which was mitigated by introducing manual environment approval gates.