Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
vectorize-io/hindsight
main @ 9dafadc
42
Fixes
0
CVEs
CRITICAL
Peak severity
16.7%
Coverage
Highlights
Auth Bypass: 16 prior fixes. Scrutinize any change in this area.
hindsight-api/hindsight_api/api/http.py: most-fixed (6 issues). Treat as high-risk during review.
16 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Several API endpoints directly queried the database pools without performing context validation or verifying tenant authentication, allowing potential cross-tenant or unauthenticated access to sensitive bank metrics and configurations.
Auth Bypass: The Model Context Protocol (MCP) endpoints and middleware relied on static token verification or lacked proper tenant gating, exposing administrative engine operations like deleting memory units to unauthorized calls.
Denial of Service: Unsanitized input containing special-token literals or lone UTF-16 surrogates caused unhandled application crashes in tokenizers, and unbounded history sizes in mental models resulted in Postgres jsonb overflows.