Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

comet-ml/opik

              main @ 76ded4d
            

Fixes

CVEs

CRITICAL

Peak severity

35.1%

Coverage

Highlights

Auth Bypass: 26 prior fixes. Scrutinize any change in this area.

apps/opik-backend: most-fixed (7 issues). Treat as high-risk during review.

28 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A pattern of missing annotation-based permissions allowed unauthenticated or cross-tenant access to sensitive endpoints like dashboards, datasets, and API keys. The fix required systemic application of @RequiredPermissions across private resources.

Auth Bypass: Multiple entry points resolving projects, spans, and traces failed to verify if requested resources belonged to public projects or the requester's workspace context, leaking private tracing structures.

Cross-Tenant Data Leakage: The database query for deleting dataset export jobs by IDs lacked a tenant or workspace validation check, creating a cross-tenant deletion vulnerability.