Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gastownhall/beads
main @ 5aa4474
55
Fixes
0
CVEs
HIGH
Peak severity
25.6%
Coverage
Highlights
Information Disclosure: 9 prior fixes. Scrutinize any change in this area.
cmd/bd: most-fixed (4 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The application historically executed arbitrary command strings via shell-based execution (sh -c) when handling imports and remote actions, allowing direct remote code execution.
SQL Injection: Probing database metadata without escaping backticks in identifiers allowed SQL injection payloads via malicious database names.
Path Traversal: Path validation mechanisms under directory targets failed to resolve symlinks or validate path boundaries properly, enabling files outside of secure roots to be manipulated.