Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Mergifyio/mergify

              main @ 003cd3e
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Auth Bypass: 13 prior fixes. Scrutinize any change in this area.

mergify_engine/actions/delete_head_branch.py: most-fixed (2 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address unauthorized command execution via comment-triggered commands, indicating recurring gaps in permission checks and command lookup ordering across different command execution paths.

Auth Bypass: Authentication for web/dashboard endpoints has been repeatedly hardened, including API key validation, case-insensitive scope checks, and adding missing authorization headers, showing a pattern of incomplete authentication on HTTP endpoints.

Auth Bypass: Merge and review-related permission checks have been inconsistently applied, with fixes adding checks for merge bot accounts, branch protections, and reviewer permissions, indicating a systemic issue in validating user roles before sensitive actions.