Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Syslifters/sysreptor

              main @ c0d6ffc
            

Fixes

CVEs

HIGH

Peak severity

25.8%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

api/src/reportcreator_api/pentests/permissions.py: most-fixed (6 issues). Treat as high-risk during review.

22 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes in the websocket consumer address permission bypasses: read-only users could write, expired sessions were accepted, and connections persisted after revocation. This component is a high-risk surface for real-time authorization enforcement.

Authorization Bypass: Permission classes for project types, subresources, and comments have been repeatedly patched to close gaps like missing readonly checks, guest write access, and over-privileged admins. These fixes show a pattern of incomplete permission logic.

Auth Bypass: API token authentication bypassed sensitive-operation reauthentication and could access other users' data. A separate fix removed a check that blocked token auth to an SSO endpoint, indicating confusion about token scope.