Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

julep-ai/julep

              dev @ 5371a62
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Broken Access Control: 5 prior fixes. Scrutinize any change in this area.

agents-api/agents_api/models: most-fixed (3 issues). Treat as high-risk during review.

16 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Systemic query injection vulnerabilities existed across database models due to string interpolation in database operations. Mitigations required migrating to parameterized queries and JSON serialization of complex parameters.

Insecure Deserialization: The use of an insecure YAML parser (pyyaml) allowed potential arbitrary code execution, which was resolved by migrating to a safer parser architecture (ruamel.yaml).

Authentication Bypass: Extracting developer identities from client-controlled request headers rather than cryptographically validated token claims allowed users to easily masquerade as other tenants.