Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

antiwork/gumroad

              main @ 1ca7656
            

Fixes

CVEs

CRITICAL

Peak severity

38.9%

Coverage

Highlights

Auth Bypass: 26 prior fixes. Scrutinize any change in this area.

app/controllers/signup_controller.rb: most-fixed (3 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Direct string interpolation of untrusted HTTP query parameters into ActiveRecord where clauses allowed arbitrary SQL execution.

Auth Bypass: Accessing and modifying sensitive transaction records via guessable, plain sequential or public external identifiers rather than cryptographically signed and scoped tokens.

Command Injection: Untrusted document names or page parameters were interpolated directly into shell execution utilities like Subexec, allowing command execution on the host system.