Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

RoboSats/robosats

              main @ ac0a785
            

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

api/views.py: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Secret Exposure: Hardcoded SECRET_KEY in source code is a direct, critical exposure that compromises all cryptographic operations and session integrity.

Auth Bypass: Two separate auth bypasses in order views: one missing password check on order-taking, another missing participant check on GET data. This indicates a systemic weakness in enforcing authorization on order operations.

Race Condition: Double-withdrawal race condition on rewards demonstrates that financial state transitions lack proper concurrency control, risking direct loss of funds.