Security context

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

internal/pkg/middleware/auth.go: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The application relies on custom middleware for JWT validation, which historically missed explicit token validation state checks and critical claims verification like audience checks. If bypassed, malicious actors can gain unauthorized administrative access.

Auth Bypass: A logical targeting error in the secrets controller historically executed policies deletion instead of secrets deletion, circumventing intended resource limits and access boundaries.

Auth Bypass: An initialization sequence race condition allowed HTTP routes to be installed and serve requests before internal data stores and authorization engines were fully initialized.