Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
appflowy-io/appflowy
main @ 5cf3a36
7
Fixes
0
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Auth Bypass: 5 prior fixes. Scrutinize any change in this area.
backend/src/user_service/auth.rs: most-fixed (2 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Client-controlled user_id in request body allowed users to act on behalf of others; fixed by deriving user from authenticated session.
Auth Bypass: Guests could gain full access without checks on page creator and workspace role; fixed by adding those checks.
Auth Bypass: Unauthorized page editing and guest access were possible due to missing access level enforcement; fixed by adding enforcement and guest restrictions.