Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

doocs/md

              main @ f50b5e5
            

Fixes

CVEs

HIGH

Peak severity

57.1%

Coverage

Highlights

Cross-Site Scripting (XSS): 3 prior fixes. Scrutinize any change in this area.

apps/api/src/share-sanitize.ts: most-fixed (1 issue). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): The application repeatedly introduced XSS vulnerabilities by attempting to sanitize raw inputs rather than the compiled HTML output of the Markdown parser. Inconsistent sanitization across the webview panel, AI assistant UI, and state store allowed malicious payloads to bypass safeguards.

Credential Leak: Sensitive credentials, specifically GitHub Personal Access Tokens (PATs) used for image uploads, were repeatedly hardcoded and exposed in frontend code. The architecture required a redesign to route requests through a secure backend proxy.

Auth Bypass: Webhooks trusted unverified user payloads to grant premium status. The endpoint was vulnerable to fraud until a path-secret token verification and official server-side API check were implemented.