Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

chain305/chainsaw-core

              main @ 4f6f2f6
            

Fixes

CVEs

HIGH

Peak severity

20.0%

Coverage

Highlights

Credential Lifecycle / Privilege Escalation: 1 prior fix. Scrutinize any change in this area.

SECURITY.md: most-fixed (1 issue). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Security Control Bypass: Acquisition failure was treated as a benign miss, allowing silent ALLOW; this is a classic fail-open pattern that undermines the entire guard.

Supply Chain Verification Bypass: Certificate identity was not pinned to exact workflow path and org casing, allowing a malicious workflow to mint a passing cosign certificate.

SSRF: Outbound HTTP requests to user-supplied URLs lacked centralized IP/hostname allowlist, risking internal/metadata endpoint access.