Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jumperexchange/jumper-exchange

              develop @ def7d3a
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Information Disclosure: 3 prior fixes. Scrutinize any change in this area.

src/app/lib/*: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: The application exposed raw environment variables without filtering, allowing sensitive backend credentials or system secrets to be leaked to the frontend via the configuration utility. Developers must strictly enforce the NEXT_PUBLIC_ prefix allowlist to restrict exposed variables.

Auth Bypass: Server-to-server requests made to Strapi did not include authorization headers, potentially bypassing wallet access controls. Ensuring all outgoing backend fetch requests append valid Bearer authentication headers is vital to enforce authorization boundaries.

Information Disclosure: Strapi API access tokens were directly embedded in client-side network requests, exposing administrative privileges to the public internet. Sensitive tokens must only be processed server-side.