Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

liam-hq/liam

              main @ 92156ea
            

Fixes

CVEs

CRITICAL

Peak severity

53.1%

Coverage

Highlights

Auth Bypass: 16 prior fixes. Scrutinize any change in this area.

frontend/apps/app/middleware.ts: most-fixed (5 issues). Treat as high-risk during review.

22 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Identifier escaping was missing in PostgreSQL schema deparsing helper functions, exposing database driver query executions during RENAME COLUMN, DROP INDEX, and CREATE INDEX statement generation to critical SQL injection payloads.

Auth Bypass: Middleware path restrictions were bypassed or bypassed via headers due to reliance on spoofable user-controlled headers (like X-Forwarded-Host), requiring a migration to trusted proxy headers and elimination of API route exclusions to consistently enforce sessions.

SSRF: User-supplied schema URLs were fetched without strict domain whitelist checks, or with fail-open default configurations and look-alike domain bypasses, allowing attackers to perform internal server-side request forgery (SSRF).