Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
router-for-me/cliproxyapi
main @ b53d1e9
57
Fixes
1
CVEs
HIGH
Peak severity
35.1%
Coverage
Highlights
Auth Bypass: 23 prior fixes. Scrutinize any change in this area.
internal/api/handlers/management/auth_files.go: most-fixed (6 issues). Treat as high-risk during review.
26 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The authentication conductor repeatedly fails to normalize model aliases and strip suffix additions (like thinking parameters) prior to looking up valid credentials, leading to permission-isolation and credential-matching bypasses.
Path Traversal: Management endpoints managing sensitive auth files consistently allow directory traversal because they omit proper canonicalization and absolute path prefix-validation, allowing arbitrary reads and writes.
Auth Bypass: Remote and local management paths trust user-controlled HTTP proxy headers and possess logical flaws that bypass authorization keys entirely unless explicit local IP checks and disabled-key overrides are strictly enforced.