Security context

Highlights

Auth Bypass: 24 prior fixes. Scrutinize any change in this area.

echo.go: most-fixed (14 issues). Treat as high-risk during review.

42 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Route grouping logic has repeatedly failed to inherit, copy, or execute parent/group middleware correctly. This allows sub-routes or fallback catch-all routes to accidentally skip critical security and authentication filters.

Path Traversal: Path normalization disparities (e.g., between forward and backward slashes on Windows, or handling double URL-escaped separators) have consistently enabled directory traversal attacks in the static file serving middleware.

Auth Bypass: The JWT middleware historically shared mutable configuration/claims context across concurrent requests. This data race and state sharing vulnerability allowed different concurrent connections to corrupt or leak JWT session claims.