Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cloudflare/freighter

              main @ 0bcf163
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 8 prior fixes. Scrutinize any change in this area.

crates/freighter-auth/src/cf_backend.rs: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Default auth methods allowed unrestricted access to index and download endpoints; changed to deny-all, a classic fail-open pattern.

Auth Bypass: Service token detection could be bypassed by inconsistent sub/common_name claims, allowing impersonation.

Auth Bypass: Any service token could publish crates; fixed by adding explicit allowlist check on token ID.