Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

yuezk/globalprotect-openconnect

              main @ 10e94e0
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Insecure Storage: 2 prior fixes. Scrutinize any change in this area.

GPClient: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Storage: Plaintext sensitive credentials (usernames and passwords) were historically saved to persistent configuration settings. Developers should completely avoid ad-hoc serialization of credentials and rely exclusively on secure OS-level keyrings.

Insecure Storage: Improper platform integration for credential storage was addressed by replacing plaintext persistence with QtKeychain/libsecret. Any new authentication workflows must strictly channel credentials through this secure layer.

Information Disclosure: Temporary HTML authentication files were generated with insecure permissions, creating a window for local attackers to extract credentials. Secure 0o600 permissions and explicit cleanup blocks must be enforced for all local scratch files.