Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
stripe/stripe-java
master @ 7cacae5
3
Fixes
0
CVEs
MEDIUM
Peak severity
66.7%
Coverage
Highlights
Information Disclosure: 1 prior fix. Scrutinize any change in this area.
.github/workflows: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Resource identifiers used in API path generation were formatted directly without canonicalization or URL encoding, allowing attackers to manipulate resource IDs to perform path traversal and redirect API requests to unexpected endpoints.
Information Disclosure: Passing unmodified original parameter maps instead of sanitized copies during deauthorize requests can leak sensitive client credentials or parameters that should have been stripped or modified.
Privilege Escalation: Overly permissive default workflow tokens (github.token) pose a privilege escalation risk if an attacker successfully compromises a workflow run. Minimizing scopes to read-only where possible is critical.