Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cloudflare/ai
main @ 976ab71
13
Fixes
3
CVEs
HIGH
Peak severity
54.5%
Coverage
Highlights
Auth Bypass: 9 prior fixes. Scrutinize any change in this area.
demos/mcp-slack-oauth/src/slack-handler.ts: most-fixed (2 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Lack of PKCE verifiers and HMAC-signed state tokens allowed attackers to bypass authorization controls, hijack authorization codes, and inject state. Implement strong PKCE verification and HMAC checks on the callback endpoint.
Auth Bypass: Acceptance of unverified, client-side base64-encoded state parameters led to direct session and state hijacking. All state payloads must be cryptographically signed, encrypted, and backed by state validation checks.
CSRF: Missing secure session binding for OAuth state tokens allowed cross-site request forgery attacks on authentication flows. State tokens must be bound to the user session using cryptographically hashed cookies.