Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
bricks-cloud/BricksLLM
main @ c7d80a6
23
Fixes
0
CVEs
HIGH
Peak severity
52.2%
Coverage
Highlights
Auth Bypass: 15 prior fixes. Scrutinize any change in this area.
internal/policy/policy.go: most-fixed (4 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple high-severity bypasses in the middleware: nil policyInput bypassing filters, missing user/model/path authorization, and unenforced revoked status/rate limits. These indicate the middleware is a critical chokepoint where checks are easily skipped or incomplete.
Auth Bypass: Policy engine has repeated bypasses: wrong error type for AllowButWarn, ignored inspection errors, and missing PII scanner integration. This shows enforcement logic is fragile and can silently let blocked content through.
Auth Bypass: Two provider-specific path prefix bypasses (Bedrock and vLLM) show that per-provider access checks are inconsistently applied and can be circumvented with non-matching prefixes.