Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

davepoon/buildwithclaude

              main @ 8e9d1f0
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

plugins/codex-hud/commands/setup-key.md: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Administrative API routes previously lacked token verification, exposing the submission review functionality to unauthorized actions prior to implementing bearer token checks.

Auth Bypass: The project boundary safety plugin was vulnerable to directory traversal and boundary bypasses due to insufficient command parsing, resolved by implementing path canonicalization and option validation.

Stored XSS: Unsanitized link URLs allowed arbitrary protocols like javascript: or data:, leading to client-side Cross-Site Scripting (XSS) in shared story components.