Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

frigadehq/trench

              main @ 43add90
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

apps/trench/src/api-keys/api-keys.service.ts: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Direct Object Reference (IDOR): Workspace endpoints allowed cross-workspace modifications (GET, PUT, DELETE) because operations trusted user-supplied path parameters without verifying that the authenticated user belonged to the requested workspace. Developers must ensure all workspace-scoped actions use session-derived identifiers.

Auth Bypass: API key validation historically relied on static environment variables rather than database-backed workspace lookup, which allowed authentication bypass and lack of tenant isolation during data querying. Key validation must always cross-reference the workspace database and cache.