Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
sciphi-ai/r2r
main @ 9c5a94d
8
Fixes
0
CVEs
HIGH
Peak severity
62.5%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
py/core/main/api/management_router.py: most-fixed (1 issue). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The application failed to reject JWT decoding when JWT_SECRET was unset, which could allow signature verification bypasses. Developers must enforce strict configuration checks to ensure cryptographic signatures are always validated.
Auth Bypass: Websocket streaming endpoints skipped standard HTTP authentication barriers, requiring a specific websocket authentication wrapper to prevent unauthenticated logs access.
Auth Bypass: Incomplete tenant/collection isolation in management routers allowed unauthorized access to sensitive document chunks. Checking the intersection of user collection memberships is required.