Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
amalshaji/portr
main @ f501571
5
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
admin/src/portr_admin/apis/v1/auth.py: most-fixed (1 issue). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Incomplete validation during GitHub OAuth logins previously allowed unregistered users or those outside allowed email domains and teams to create accounts or authenticate successfully. Developers should ensure all registration callbacks strictly verify team membership and domain constraints.
Auth Bypass: A duplicate or parallel registration path implemented in Go bypassed registration eligibility checks, enabling unauthorized user registration. Ensuring consistent invite and domain policy enforcement across both backend implementations is critical.
Auth Bypass: Inactive users were previously able to authenticate and log in via GitHub OAuth because their status was not evaluated during the callback loop. It is vital to check 'is_user_active' status before issuing session tokens.