Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
GaloyMoney/blink
main @ 6c53673
36
Fixes
0
CVEs
CRITICAL
Peak severity
48.3%
Coverage
Highlights
Auth Bypass: 16 prior fixes. Scrutinize any change in this area.
src/servers/graphql-server.ts: most-fixed (5 issues). Treat as high-risk during review.
23 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple critical and high-severity auth bypasses in the main GraphQL server, including optional JWT verification, missing IP blacklist checks, and WebSocket header handling.
Payment Validation Bypass: Critical fix for invoice amount validation and quote expiration, indicating a direct financial loss vector if not enforced.
Auth Bypass: Unauthenticated USD endpoints were fixed by adding auth and walletId validation, showing a pattern of new endpoints missing standard guards.