Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
vstorm-co/full-stack-ai-agent-template
main @ 86e5b90
8
Fixes
0
CVEs
HIGH
Peak severity
40.0%
Coverage
Highlights
SSRF: 3 prior fixes. Scrutinize any change in this area.
backend/app/api/routes/v1/conversations.py: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Insecure Direct Object Reference (IDOR) flaws and missing admin bypass checks historically allowed unauthenticated or unauthorized access to other users' conversation histories and messages. Developers must strictly enforce user_id validation and verify user ownership of queried conversation resources.
SSRF: Outbound webhook triggers are susceptible to Server-Side Request Forgery. Attackers can leverage these endpoints to probe internal services, target link-local/private networks, or execute DNS rebinding attacks unless destination IPs are recursively validated immediately before connection.
SSRF: Generic IP validation helper functions failed to account for Python standard library parsing quirks, such as the 100.64.0.0/10 Shared Address Space (CGNAT) and embedded credentials (userinfo) in URLs, enabling parser-differential SSRF bypasses.