Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
bittorrent/go-btfs
master @ 299483c
187
Fixes
0
CVEs
HIGH
Peak severity
54.1%
Coverage
Highlights
Denial of Service: 104 prior fixes. Scrutinize any change in this area.
core/commands/config.go: most-fixed (14 issues). Treat as high-risk during review.
58 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Sensitive wallet actions—including withdrawals, deposits, and key resets—could be triggered without proper authorization because password checks and configuration validation flags were missing or shadowed. Setting 'NoRemote' guards and forcing explicit password validation prevents unauthorized manipulation of wallet balances.
Information Disclosure: Node configuration commands routinely risked leaking sensitive components (like unencrypted mnemonics and peer private keys) in plain text over the API or within localized CLI output due to inadequate sanitization and case-insensitive redacting logic.
Denial of Service: The lack of execution deadlines, context propagation, and resource capacity limits (such as remaining disk validation and concurrent session locks) in storage contracts permitted arbitrary actors to trigger persistent resource consumption and memory starvation.