Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tw93/pake

              main @ ba7ff58
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

src-tauri/src/app/window.rs: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Insecurely scoped SSO detection heuristics can expose authentication credentials to untrusted, non-enterprise domains loaded within the webview context.

Sandbox Escape: Webview-initiated downloads on high-security CSP sites or sandboxed iframes can fail or trigger insecure fallback behaviors if native handlers are bypassed.