Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tighten/jigsaw

              main @ 0157e3f
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

(.github/workflows/add-to-project.yml): most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The local development server command did not properly sanitize or escape input parameters before passing them to the shell, allowing attackers to execute arbitrary system commands via crafted build path arguments. Developers must always run argument escaping mechanisms when invoking system commands from PHP code.

Auth Bypass: Running untrusted workflow definitions in the context of the base repository allowed arbitrary pull request code to access highly privileged repository secrets. Enforcing secure triggers prevents unauthorized workflow modification or secret exfiltration.