Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

verida/verida-js

              main @ 0b0fac8
            

Fixes

CVEs

HIGH

Peak severity

16.7%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

packages/account-web-vault/src/auth-client.ts: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: External user-permissioned databases could be instantiated without validating encryption keys for non-owners, leading to unauthorized read/write access. Ensure all database loaders strictly validate credentials.

Cryptographic Issues: Signature verification could fail or be bypassed due to mismatches in public key formats (e.g., hex versus shortened address format). Comparisons must normalize public key formats before verification.

Auth Bypass: Local database writes could be performed by non-owners without write permissions. The database context must force a read-only configuration when write permission is not explicitly verified.