Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Shopify/shopify-app-php
main @ 0f84ecd
3
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
src/Internal/Exchange/ClientCredentials.php: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Reusable OAuth credentials (access_token, refresh_token, client_secret) were being logged in token endpoint response bodies, directly exposing long-lived secrets to anyone with log access.
Information Disclosure: Sensitive fields in both request bodies (client_secret, subject_token, refresh_token) and response bodies (access tokens) were logged without redaction across multiple OAuth and GraphQL components, indicating a systemic logging hygiene gap.
Open Redirect: Redirect URLs containing control characters (tab, newline, carriage return) could be normalized by browsers into protocol-relative URLs, enabling an open redirect from the app home redirect endpoint.