Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
repowise-dev/repowise
main @ db1ef2d
14
Fixes
0
CVEs
HIGH
Peak severity
8.3%
Coverage
Highlights
Denial of Service: 3 prior fixes. Scrutinize any change in this area.
packages/cli/src/repowise/cli/editor_integrations/claude_config.py: most-fixed (1 issue). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Argument Injection: User input passed directly into Git subprocess commands allowed arbitrary argument injection. Future modifications invoking external binaries must utilize safe argument lists and explicit '--' parameter delimiters to isolate flags from positional inputs.
Auth Bypass: The local OpenCode LLM integration previously ran with dangerously loose execution permissions, allowing system compromise. Restricting execution to a read-only profile is crucial to contain LLM agent behaviors.
Information Disclosure: Loading a repository's local environment files mutated the global server process context, potentially leaking credentials across isolated user workspaces. Multi-tenant context loading must avoid mutating the parent process state.