Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

coleam00/archon

              dev @ 59bbd00
            

Fixes

CVEs

HIGH

Peak severity

31.4%

Coverage

Highlights

Auth Bypass: 19 prior fixes. Scrutinize any change in this area.

packages/server/src/routes/api.ts: most-fixed (9 issues). Treat as high-risk during review.

27 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The REST API and integrated webhook endpoints frequently omitted server-side authentication gates, allowing unauthorized remote command execution and access to configuration structures. This includes webhook endpoints failing to use timing-safe comparisons and accepting empty secrets.

Command Injection: The system dynamically interpolates unsanitized user inputs, AI-generated outputs, and upstream execution payloads directly into inline shell scripts, leading to critical shell injection vulnerabilities in the workflow execution engine.

Path Traversal: File-handling endpoints for workflows, artifacts, and uploads frequently resolved paths containing user-controlled segments without performing canonicalization or prefix containment checks, exposing arbitrary local files to reading and writing.