Security context

Highlights

Auth Bypass: 10 prior fixes. Scrutinize any change in this area.

src/middlewares/auth.middleware.ts: most-fixed (3 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Flawed route exclusion and token validation logic in the authentication middleware repeatedly allowed unauthorized users to bypass route guards. Strict explicit inclusion patterns must be enforced.

Auth Bypass: Failure to properly enforce state and public visibility overrides for unauthenticated users allowed exposure of draft and private data via query parameters.

Auth Bypass: Logical flaws in admin detail lookups allowed unauthorized access to sensitive administrative articles when requesting them with specific identifier formats.