Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
openfn/lightning
main @ 3c86ddf
69
Fixes
0
CVEs
HIGH
Peak severity
27.3%
Coverage
Highlights
Auth Bypass: 44 prior fixes. Scrutinize any change in this area.
lib/lightning/policies/project_users.ex: most-fixed (4 issues). Treat as high-risk during review.
32 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inconsistent or missing role and membership validations allowed users to access resources in projects they did not belong to or bypass authorization constraints. Tightening of ProjectUsers policy assertions and role mappings was required across several iterations.
Auth Bypass: Critical session verification issues, including weak token validations and client-controlled multi-factor authentication (MFA) parameters, risked complete authentication bypasses. The platform transitioned to server-side session tracking and mandated strict MFA verification before session completion.
Auth Bypass: LiveView handlers and resource retrieval actions failed to enforce ownership checks, allowing unauthorized viewing, modification, or deletion of private credentials. This required retrofitting resource scope checks directly on credential actions.