Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

bifrost-proxy/bifrost

              main @ 71080bf
            

Fixes

CVEs

CRITICAL

Peak severity

29.2%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

and: most-fixed (3 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes in the IM gateway show permission and ownership checks were missing on message sending and group classification, allowing unauthorized agent invocation and message dispatch.

Sandbox Escape: File operations allowed sandbox escape via symlink traversal and case-sensitive deny bypass, and directory listing of sensitive paths; multiple fixes were needed to enforce path normalization and deny matching.

Path Traversal: Remote file list/glob/search operations returned entries from denied paths; fixes added deny filtering and pagination, but sibling operations may still miss filtering.