Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ava-labs/builders-hub

              master @ c14cab2
            

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Auth Bypass: 14 prior fixes. Scrutinize any change in this area.

proxy.ts: most-fixed (3 issues). Treat as high-risk during review.

33 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Global devrel role check allowed any devrel to manage judges for any hackathon; replaced with per-hackathon permission check.

Auth Bypass: Same global devrel role check pattern for editing events; replaced with canEditEvent per-hackathon authorization.

SSRF: Server-side fetch to user-controlled RPC URL without validation; added host allowlist/denylist with DNS and IP range checks.