Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

OpenByteInc/QuantDinger

              main @ 1e94165
            

Fixes

CVEs

CRITICAL

Peak severity

14.3%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

backend_api_python/app/routes/agent_v1/_security.py: most-fixed (1 issue). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection / Sandbox Escape: Untrusted strategy/indicator code executed via exec() with restricted builtins; a sandbox escape could leak environment secrets or execute arbitrary code.

Auth Bypass: A process-wide shared broker client allowed user B's order to route through user A's account, leading to cross-tenant financial impact.

Sandbox Escape / Arbitrary Code Execution: Indicator verification endpoint executed user code via exec() with insufficient sandboxing; needed restricted builtins, import allowlist, static validation, and timeout.