Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
argotorg/sourcify
staging @ fce237a
17
Fixes
0
CVEs
HIGH
Peak severity
46.7%
Coverage
Highlights
Denial of Service: 4 prior fixes. Scrutinize any change in this area.
RepositoryService: most-fixed (2 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Attackers can bypass path sanitization via newline characters or directory traversal sequences to write arbitrary files. Normalization must be rigidly applied prior to file operations.
Auth Bypass: Sensitive routes, including private verification endpoints and CREATE2 sessions, have historically lacked token authorization or validation rules, exposing privileged capabilities.
Denial of Service: Uncaught verification task rejections and improper active-job tracking can lead to worker pool exhaustion or allow duplicate expensive verification requests.