Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hmbown/codewhale

              main @ 1881fa7
            

Fixes

CVEs

CRITICAL

Peak severity

29.4%

Coverage

Highlights

Auth Bypass: 25 prior fixes. Scrutinize any change in this area.

crates/config/src/lib.rs: most-fixed (9 issues). Treat as high-risk during review.

36 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers could execute destructive shell tools or execute arbitrary code by bypassing user-configured authorization gates, manipulating auto-approval configurations, or leveraging sub-agents to bypass parenting limits.

Remote Code Execution: Auto-approval configurations on execution tools such as `cargo test` within the `run_tests` tool allowed direct execution of arbitrary code from malicious repositories.

Path Traversal: Insecure handling of project-local state directories and workspace paths allowed symbolic link traversal and uncanonicalized directory-jumping to read or write sensitive out-of-bounds files.