Security context

Highlights

Auth Bypass: 13 prior fixes. Scrutinize any change in this area.

src/express/createServer.js: most-fixed (2 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The platform struggled with extracting signatures correctly across different server frameworks, such as reading from 'request.header' instead of 'request.headers' in Koa and Restify, leading to bypassed signature checks.

Auth Bypass: Fallback mechanisms for webhook verification were insecure, defaulting to allowing verification when the required token was entirely missing.

Auth Bypass: Lack of timing-safe cryptographic equality checks allowed potential timing attacks on webhook signature validation across Slack and Viber connectors.