Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apiparklab/apipark

              main @ 6d611de
            

Fixes

CVEs

HIGH

Peak severity

18.2%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

frontend/packages/common/src/const/permissions.ts: most-fixed (3 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Ineffective gateway authentication occurred due to uninstantiated and unregistered authentication drivers. Standardized configurations for JWT, OAuth2, and AK/SK keys must be strictly registered within the gateway pipeline to prevent authentication bypass.

Auth Bypass: Establishing persistent SSE connections without verifying the client's API key against active service subscriptions allowed unauthorized clients to consume real-time events.

Auth Bypass: Sensitive routes handling subscription, application, and API documentation creation lacked explicit Workspace and Team RBAC validations, allowing unprivileged access to sensitive data and operations.