Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

OmisePayments/omise-mcp

              main @ 795f03c
            

Fixes

CVEs

CRITICAL

Peak severity

66.7%

Coverage

Highlights

Access Control Bypass: 1 prior fix. Scrutinize any change in this area.

config/development.env: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Secret Exposure: Hardcoded production API keys and Redis passwords in version control are a direct path to credential theft and payment infrastructure compromise; this was the most severe historical issue.

Access Control Bypass: Unauthorized tool invocation could allow arbitrary MCP operations; the fix enforces an exact TOOLS allowlist before callTool, but sibling paths (e.g., ListTools or future tool registrations) must enforce the same check.

Cryptographic Weakness: Weak certificate generation undermines mutual TLS authentication; the fix adds SAN and key usage extensions, but all certificate generation and validation paths must use these hardened defaults.