Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

unkeyed/unkey

              main @ 961ed1a
            

105

Fixes

CVEs

CRITICAL

Peak severity

51.4%

Coverage

Highlights

Auth Bypass: 45 prior fixes. Scrutinize any change in this area.

apps/api/src/pkg/ratelimit/client.ts: most-fixed (4 issues). Treat as high-risk during review.

52 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Frequent failure to enforce tenant (workspaceSlug/workspaceId) scoping boundaries directly inside database queries and TRPC endpoints allowed cross-tenant IDORs and unauthorized data deletion/modification.

Auth Bypass: Misuse of Next.js 'use server' directives exposed internal utility methods as public-facing unauthenticated endpoints, permitting cross-tenant state manipulation.

SQL Injection: Execution of raw SQL/ClickHouse queries with inline dynamic parameters or unescaped string patterns (e.g., in LIKE clauses) exposed the system to SQL injection.