Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
graphile/crystal
main @ ea74d3c
27
Fixes
1
CVEs
CRITICAL
Peak severity
38.5%
Coverage
Highlights
Auth Bypass: 14 prior fixes. Scrutinize any change in this area.
grafast: most-fixed (3 issues). Treat as high-risk during review.
12 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Default-allow permission resolution behavior in database-to-GraphQL field mapping can allow clients to bypass RBAC checks if permissions evaluate to undefined or null. Access control decisions must fail closed by default.
Auth Bypass: GraphQL query engine operations such as EXPLAIN ANALYZE can be leveraged to execute unauthorized underlying write operations if query classification checks (e.g. isMutation) are not strictly applied before database execution.
Auth Bypass: Flaws in translating all-null JWT token structures can result in the generation of false-positive active sessions, allowing authentication bypass if the payload structure is not fully validated.