Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
bitterbot-ai/bitterbot-desktop
main @ 6ea2574
11
Fixes
0
CVEs
HIGH
Peak severity
55.6%
Coverage
Highlights
Auth Bypass: 6 prior fixes. Scrutinize any change in this area.
src/services/x402-verify.ts: most-fixed (3 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The x402 payment verification process historically suffered from multiple logic flaws, including substring-based recipient matching, missing timestamp validation allowing replay, and race conditions (TOCTOU) in single-use enforcement. Developers must ensure any updates to verification flows strictly enforce EIP-191 personal_sign validation and exact address equality.
Auth Bypass: Execution of shell commands via agent interfaces is a high-severity risk. Attackers can leverage homoglyphs, embedded NUL bytes, process substitution, and bidirectional Unicode characters to bypass filters and execute arbitrary code.
Sandbox Escape: Untrusted tools or capabilities can execute privileged system operations (shell, network, wallet, process) unless systematically wrapped by runtime policy enforcers linked to active P2P profiles.