Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nextlevelbuilder/goclaw

              dev @ 969a587
            

159

Fixes

CVEs

CRITICAL

Peak severity

31.6%

Coverage

Highlights

Auth Bypass: 77 prior fixes. Scrutinize any change in this area.

internal/tools: most-fixed (11 issues). Treat as high-risk during review.

101 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The RPC and WebSocket routing layer failed to enforce proper fail-closed authentication, allowing unclassified methods to be processed under default-permit policies or falling back to authenticated roles upon query failures.

Path Traversal: File uploading, moving, and reading endpoints previously suffered from TOCTOU symlink vulnerabilities and lack of boundary checks, allowing unauthorized cross-tenant directory access or writing files outside of designated workspaces.

SSRF: Outbound requests from tools and provider configurations frequently bypassed simple blocklists via DNS rebinding, multi-IP resolved hosts where only the first was checked, or benchmarking IP ranges (RFC 2544).