Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hoppscotch/hoppscotch

              main @ e067ee0
            

Fixes

CVEs

CRITICAL

Peak severity

38.2%

Coverage

Highlights

Auth Bypass: 25 prior fixes. Scrutinize any change in this area.

packages/hoppscotch-backend/src/infra-config/infra-config.service.ts: most-fixed (5 issues). Treat as high-risk during review.

27 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Mass Assignment: The onboarding endpoint lacked DTO allowlist validation, enabling unauthenticated remote attackers to modify system-wide configurations and take over administrative settings.

Auth Bypass: Onboarding configurations could be re-triggered and overwritten because of a missing check on the system's completed status, leading to full infrastructure takeover.

Auth Bypass: Missing ownership validation in Prisma query methods allowed authenticated users to read, update, or delete other users' collections and environments (IDOR).