Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
GSA/search-gov
main @ 3212635
66
Fixes
0
CVEs
CRITICAL
Peak severity
69.0%
Coverage
Highlights
Auth Bypass: 18 prior fixes. Scrutinize any change in this area.
app/models/user.rb: most-fixed (6 issues). Treat as high-risk during review.
45 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple bypasses in the OAuth callback flow allowed unapproved users to establish sessions and access admin areas, indicating a fragile approval-status gate that was patched repeatedly.
Reflected XSS: Numerous fixes escaped user-controlled query and URL data in search result links, onmousedown attributes, and no-results messages, showing a broad and recurring injection surface.
Auth Bypass: User model fixes repeatedly tightened approval, email verification, and password-change requirements, indicating a core identity/authorization logic that must be consistently enforced.