Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

OpenHands/OpenHands

              main @ f26d734
            

125

Fixes

CVEs

CRITICAL

Peak severity

75.8%

Coverage

Highlights

Auth Bypass: 34 prior fixes. Scrutinize any change in this area.

enterprise/server/routes/auth.py: most-fixed (7 issues). Treat as high-risk during review.

81 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring auth bypasses across middleware, permission checks, and OAuth callbacks; fixes address missing checks, header recognition, and org scoping, indicating systemic gaps in authentication enforcement.

Information Disclosure: Secrets (API keys, tokens, MCP configs) leak through logs, serialization, and URL parameters across many components; fixes focus on redaction and SecretStr usage, indicating pervasive credential exposure.

Command Injection: Shell command execution with unsanitized user input (branch names, file paths) recurs; fixes add quoting and validation, but sibling git operations may still be vulnerable.