Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

limecloud/lime

              main @ 9cca000
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

electron/hostCommands.ts: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The use of a hardcoded or predictable default API key allows remote attackers to easily bypass authentication mechanisms if not rotated immediately on startup. This has been mitigated by generating a secure, randomized key on first-run.

Auth Bypass: Critical API endpoints such as `/v1/routes` were previously exposed without mandatory API key validation, while debug endpoints remained active in release builds, presenting a severe unauthorized access surface.

Auth Bypass: Missing fail-closed validation on shell launch descriptors during the preparation of Agent App host commands allowed potential privilege execution or command injection when spawning Electron windows.