Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nofxaios/nofx

              dev @ b95da3e
            

Fixes

CVEs

CRITICAL

Peak severity

54.8%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

api/server.go: most-fixed (10 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Unauthenticated HTTP endpoints originally allowed remote password/account resets, administrative mode bypasses, and orphan resource adoption. Developers must ensure any new API routes are gated by authenticating middleware and do not contain backdoors or automated registration bypasses.

Cleartext Transmission of Sensitive Information: Private exchange configurations and API keys were previously transmitted in plaintext between the frontend client and the backend server. Maintaining robust hybrid encryption (RSA-OAEP + AES-GCM) during transit is vital to prevent intercept of active trading keys.

Information Disclosure: Sensitive credentials, master keys, and exchange secrets were frequently exposed via API JSON responses and internal system log prints. Strict data transfer object (DTO) sanitization and log masking are necessary to avoid accidental exposure.