Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

airbnb/lottie-android

              master @ 05ea92e
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Token/Credential Theft: 2 prior fixes. Scrutinize any change in this area.

.github/workflows: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Token/Credential Theft: Insecure use of tools like mshick/add-pr-comment within untrusted pull request execution contexts posed a severe threat of exfiltrating sensitive GitHub tokens and repository credentials. This risk was mitigated by separating the build execution from the commenting workflow via workflow_run triggers.

Auth Bypass: The use of pull_request_target on untrusted code execution paths bypassed repository access boundaries, allowing external forks to execute code with write permissions and access secrets. Switching the trigger to pull_request closed this vulnerability.

Credential Theft: Running snapshot tests requiring emulator-wtf credentials in an integrated pull-request context allowed untrusted code to read or abuse sensitive API keys. This required isolating the test runner step into a post-build trigger.