Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ballerine-io/ballerine
dev @ 4303cd3
30
Fixes
0
CVEs
HIGH
Peak severity
34.6%
Coverage
Highlights
Auth Bypass: 18 prior fixes. Scrutinize any change in this area.
services/workflows-service: most-fixed (3 issues). Treat as high-risk during review.
20 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multi-tenant data isolation could be bypassed due to weak request-scoped context propagation when querying the Prisma database. Safe isolation must be enforced via dependency-injected scoped services.
Auth Bypass: A critical null-pointer or missing check in the API key middleware allowed requests to proceed even when the database lookup for the customer context returned null, resulting in full authentication bypass.
Auth Bypass: Relying on regex route-matching middleware to enforce session authentication permitted bypasses if path patterns were slightly altered. Standardizing on a global NestJS guard mitigates this risk.