Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rairprotocol/rair-dapp

              main @ 0afccca
            

Fixes

CVEs

CRITICAL

Peak severity

47.2%

Coverage

Highlights

Auth Bypass: 42 prior fixes. Scrutinize any change in this area.

demo-decrypt-node/bin/routes/auth.js: most-fixed (7 issues). Treat as high-risk during review.

52 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flaws in cryptographic signature recovery, such as treating undefined signature outputs as matching or trusting raw unverified keys, allowed complete authentication bypass on Web3 signature checks.

Command Injection: User-supplied media file metadata and file names were directly interpolated into system commands via execPromise, leading to potential remote code execution (RCE) via shell injection.

Sensitive Data Exposure: Hardcoded deployment files, local environment configurations, and cluster manifests committed plaintext database credentials, HashiCorp Vault secrets, and third-party API keys directly to git.