Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

gethomepage/homepage

              dev @ 9b014e4
            

Fixes

CVEs

CRITICAL

Peak severity

29.2%

Coverage

Highlights

Denial of Service: 5 prior fixes. Scrutinize any change in this area.

src/pages/api/services/proxy.js: most-fixed (7 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Multiple path traversal bypasses occurred within the service proxy handler due to flawed canonicalization and insufficient validation of directory traversal sequences and backslashes in endpoint parameters.

Auth Bypass: The proxy relied on raw, user-supplied query parameters to determine the target widget type, permitting unauthorized backend endpoint consumption. Additionally, some services bypassed credential requirements by routing via generic handlers instead of credentialed ones.

Information Disclosure: Sensitive connection strings, usernames, passwords, and API keys configured for backend widgets were repeatedly leaked to the client frontend due to incomplete payload sanitization.