Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
crossbell-box/xlog
dev @ 8b4ef0c
12
Fixes
0
CVEs
HIGH
Peak severity
55.6%
Coverage
Highlights
Auth Bypass: 6 prior fixes. Scrutinize any change in this area.
src/markdown/sanitize-schema.ts: most-fixed (3 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Custom domain and subdomain routing is highly vulnerable to domain hijacking and unauthorized tenant resolution if host header ownership is not continuously validated against registered tenant metadata.
Reflected XSS: Markdown rendering with Rehype is a constant source of XSS vectors if allowlist configurations and element attribute controls (such as iframe style configurations or media attributes) are not rigorously tightened.
Auth Bypass: Dashboard routes are susceptible to unauthorized access and layout exposure if permissions are not strictly evaluated, or if client-side redirects fail to properly block the rendering of children elements when permissions are absent.