Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

onekeyhq/app-monorepo

              x @ 3a8fe25
            

148

Fixes

CVEs

HIGH

Peak severity

26.3%

Coverage

Highlights

Auth Bypass: 63 prior fixes. Scrutinize any change in this area.

Workflows: most-fixed (5 issues). Treat as high-risk during review.

68 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Sensitive background and private keyless wallet APIs were exempted from origin validation or exposed on the global whitelist, allowing unauthorized cross-origin method invocation.

Sandbox Escape: Electron BrowserWindow and DesktopWebView instances configured with insecure web preferences (such as disabled sandboxing, allowed insecure content, and enabled node integration) permitted renderers to escape local security restrictions.

Signature Verification Bypass: A lack of strict post-sign cryptographic and UUID match validation on transaction responses (especially QR/Airgap payloads) could allow signed transaction parameters to be manipulated or spoofed.