Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Luzifer/ots

              master @ 9d0f4cf
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

api.go: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Two separate XSS fixes show this is a recurring weakness in how server data is rendered into the page; one involved embedding JSON in a parsed string, the other relied on inline scripts without a nonce.

Denial of Service: Two DoS fixes target the same API request path: one limits payload size via MaxBytesReader, the other validates expiry input to reject negative values. Both indicate a need for strict input bounds on all API parameters.

Access Control: A zero expiry override bypassed the configured expiry policy, creating non-expiring secrets. This is an access-control failure stemming from inadequate validation of an optional input.