Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
thunderbird/thunderbolt
main @ 3264a41
64
Fixes
1
CVEs
HIGH
Peak severity
46.9%
Coverage
Highlights
Auth Bypass: 24 prior fixes. Scrutinize any change in this area.
backend/src/api/powersync.ts: most-fixed (6 issues). Treat as high-risk during review.
45 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical endpoints (token, upload, and data write operations) repeatedly suffered from lack of authentication, missing session-to-device binding, and timing-unsafe comparisons. Attackers could spoof signatures or modify client-writable columns like user_id and id during operations.
SSRF: Multiple proxy and link-preview fetching components lacked validation checks against local, loopback, or complex IPv6 addresses (like NAT64/Teredo), exposing the system to Server-Side Request Forgery and DNS rebinding attacks.
Command Injection: GitHub Actions workflows dynamically executed helm or shell inline strings with untrusted inputs, allowing arbitrary shell command execution inside CI runners.