Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
18F/identity-dashboard
main @ 9e8bc76
79
Fixes
0
CVEs
CRITICAL
Peak severity
39.4%
Coverage
Highlights
Auth Bypass: 36 prior fixes. Scrutinize any change in this area.
app/models/service_provider.rb: most-fixed (8 issues). Treat as high-risk during review.
55 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes in this controller address missing authorization on team membership actions, including skip_authorization, unauthorized deletion, and un-scoped user lookups. This is a high-traffic surface for privilege escalation and cross-team access.
Auth Bypass: Base policy role checks (user_is_gov_partner?, user_has_login_admin_role?) were repeatedly tightened to exclude readonly users and partner admins from elevated privileges. These are foundational checks that affect all policies inheriting from BasePolicy.
Open Redirect: Redirect URI validation has been patched multiple times (wildcard rejection, scheme/host requirement, localhost checks), indicating an ongoing struggle to prevent open redirects through service provider configuration.