Security context

Highlights

Denial of Service: 270 prior fixes. Scrutinize any change in this area.

internal/proxy: most-fixed (53 issues). Treat as high-risk during review.

165 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The highly privileged `/expr` debug endpoint was exposed without proper authentication, enabling arbitrary expression evaluation and data manipulation (as documented in CVE-2026-26190). Developers must ensure that all debugging, administrative, and utility HTTP endpoints are closed by default and strictly gated behind the central authentication interceptor.

Auth Bypass: Flaws in Casbin rule validation, including inverted argument order in `globMatch` and concurrent state sharing of the global Casbin model, have historically led to direct authorization bypasses. Multi-resource endpoints and collection aliases must have their names fully resolved and verified within thread-safe, cloned Casbin enforcement contexts to prevent privilege boundary leakage.

Denial of Service: Unbounded input parameters such as excessive TopK search values, oversized collection descriptions, and unvalidated pagination limit/offset values routinely trigger resource exhaustion, memory exhaustion (OOM), and process crashes. Enforcing strict, early-stage limit validation in the proxy before downstream routing is critical to prevent denial of service.