Security context

Highlights

Auth Bypass: 15 prior fixes. Scrutinize any change in this area.

back/loaders/express.ts: most-fixed (12 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Express middleware authentication checks have repeatedly suffered from loose string parsing, lack of case-sensitivity normalization, and improper whitelist checks, allowing direct authorization bypasses on core administrative APIs. Developers must ensure routes are normalized, matched strictly, and case-sensitive routing is globally enforced.

Path Traversal: Creation and lookup of log directory paths was vulnerable to arbitrary directory traversal. The fix requires resolving target paths against a trusted base directory and checking for strict prefix matching prior to invoking file-system creation calls.

Command Injection: Executing notification scripts or shell tasks with raw user inputs exposes the shell parser to command injection. Arguments passed to child processes must be strictly validated, or encapsulated inside secure quoting layers to prevent parameter breakout.