Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
refinedev/refine
main @ 779d52a
8
Fixes
2
CVEs
HIGH
Peak severity
57.1%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
packages/core/src/components/authenticated/index.tsx: most-fixed (2 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The core security wrapper component previously rendered protected children before resolving the underlying authentication promise, leading to a complete bypass of route protection during early rendering cycles.
Auth Bypass: Discrepancies in case-folding when checking resource authorization in components like the Antd Sider could allow users to bypass granular access control policies by capitalizing or lowercasing resource routes inconsistently.
Auth Bypass: The Supabase authProvider allowed authentication checks to succeed even when no valid, active user session was actually returned from the authentication backend.