Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ascending-llc/jarvis-registry
main @ 1ca1c62
77
Fixes
0
CVEs
CRITICAL
Peak severity
52.9%
Coverage
Highlights
Auth Bypass: 65 prior fixes. Scrutinize any change in this area.
registry/auth/middleware.py: most-fixed (12 issues). Treat as high-risk during review.
62 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Unauthenticated endpoints allowed arbitrary JWT generation, which was solved by migrating token generation securely behind a CurrentUser dependency in the registry. Weak token verification was also hardened by moving from symmetric keys to RS256.
Auth Bypass: The unified authentication middleware repeatedly suffered from route-matching bypasses due to wildcard path exemptions (such as '/redirect/{path:path}' and loose matching of '/api/auth/me'), requiring migration to structured route compilation and explicit allowlist narrowing.
Cryptographic Issues: OAuth client secrets, access tokens, and refresh tokens were historically stored in cleartext within MongoDB, risking total credential exposure in the event of database compromise.