Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

floating/frame

              develop @ dac4378
            

Fixes

CVEs

CRITICAL

Peak severity

44.0%

Coverage

Highlights

Auth Bypass: 14 prior fixes. Scrutinize any change in this area.

main/api/origins.ts: most-fixed (2 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Exposing Node.js integration to untrusted renderer contexts allowed arbitrary main process control, bypassing core application security boundaries. Developers must strictly disable nodeIntegration and enforce contextIsolation across all BrowserWindow instances.

Sandbox Escape: Misconfigured Electron main windows allowed untrusted web views to escape sandbox restrictions and potentially execute host shell commands. Sandboxing must be universally applied to all webviews.

Auth Bypass: Incoming signature and transaction requests did not validate that they originated from the currently active, verified account context, allowing potential signing over arbitrary transactions. Requests must always match verified local accounts rather than default UI contexts.