Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ataraxy-labs/sem

              main @ bc00b75
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Information Disclosure: 1 prior fix. Scrutinize any change in this area.

crates/sem-cli/src/commands/cloud.rs: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Integrity Validation Bypass: The checksum validation mechanism failed open when metadata was missing or couldn't be fetched, allowing potentially compromised or tampered release archives to be installed without verification.

Information Disclosure: Private repository metadata and clone URLs were automatically registered to cloud services, risking exposure of sensitive internal infrastructure. It now requires an explicit SEM_SYNC_PRIVATE opt-in.

Installation Integrity Bypass: The shell-based installer downloaded and extracted release tarballs directly without verifying their SHA-256 checksums, exposing users to potential MITM or source-compromise attacks.