Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

redplanethq/core

              main @ 14b4d43
            

Fixes

CVEs

HIGH

Peak severity

46.2%

Coverage

Highlights

Auth Bypass: 8 prior fixes. Scrutinize any change in this area.

apps/webapp/app/components/logs/log-details.tsx: most-fixed (1 issue). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Cross-workspace resource access was possible due to resolving tasks directly via display IDs without strict workspace scope isolation. Ensure all queries resolve records through a workspace-scoped mechanism.

Auth Bypass: Direct terminal and gateway connections could be established without authentication. Terminal sessions must enforce short-lived HMAC-signed tickets rather than raw unauthenticated proxying.

Broken Object Level Authorization: Insecure direct object reference vulnerabilities allowed modifying or deleting documents outside of the user's active workspace. Every document write or delete operation must explicitly join on the verified workspace ID.