Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
heycupola/relic
canary @ e59f980
37
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 12 prior fixes. Scrutinize any change in this area.
packages/backend/convex/secret.ts: most-fixed (3 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inconsistent authorization checks, missing organization suspension checks, or failing to validate project-level access can expose tenant data across projects. A centralized helper model is crucial to prevent unauthorized access.
Denial of Service: Exporters and mutation endpoints are susceptible to rate limit bypasses when keying limits on spoofable headers (like client IP) instead of authenticated identities, or when performing rate validation too late in the execution flow.
Information Disclosure: Sensitive cryptographic secrets and environment variables can linger in system memory buffers if FFI interfaces or local executions do not explicitly zero out allocations in try-finally blocks.