Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
GMWalletApp/epusdt
master @ aed4a97
5
Fixes
0
CVEs
HIGH
Peak severity
60.0%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
http_server.go: most-fixed (1 issue). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Manual order marking as paid lacked on-chain validation, allowing attackers to bypass payment verification and mark unpaid orders as paid.
Auth Bypass: Install wizard routes remained accessible after setup, and default admin credential generation was insecure, enabling unauthorized reconfiguration or takeover.
Auth Bypass: SPA wildcard fallback routing swallowed backend API routes, causing requests to be misrouted to static files and bypassing API authentication.