Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
blinkospace/blinko
main @ 49fcdbb
33
Fixes
10
CVEs
CRITICAL
Peak severity
30.0%
Coverage
Highlights
Auth Bypass: 21 prior fixes. Scrutinize any change in this area.
server/routerTrpc/user.ts: most-fixed (5 issues). Treat as high-risk during review.
24 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: OAuth callback and strategy registration endpoints previously allowed authentication bypasses if requests were processed before the OAuth strategies were fully initialized or verified. This can lead to unauthorized session generation.
Path Traversal: Endpoints such as `saveDevPlugin` and `saveAdditionalDevFile` allowed authenticated attackers to write arbitrary files outside the designated development directories due to lack of path canonicalization and prefix validation.
Auth Bypass: Insecure direct object reference (IDOR) and missing permission checks on critical user endpoints, such as user upsert and details, allowed normal users to modify other accounts, escalate privileges to superadmin, or leak administrative tokens.