Security context

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

src/nvhttp.cpp: most-fixed (6 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Multiple fixes address incomplete or state-confused client certificate authorization, indicating a fragile trust model where disabled or unpaired clients could retain access.

Authentication Bypass: The pairing state machine was added to enforce step ordering, but out-of-order calls could bypass authentication; any new pairing-related endpoint must enforce the same phase checks.

Cryptographic Signature Bypass: Hardcoded RSA-2048 signature length allowed shorter keys to pass verification; the fix queries actual signature length, but any other signature verification path must do the same.