Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

codecov/umbrella

              main @ 17e0f08
            

165

Fixes

CVEs

CRITICAL

Peak severity

30.6%

Coverage

Highlights

Auth Bypass: 102 prior fixes. Scrutinize any change in this area.

apps/codecov-api/codecov_auth/views/base.py: most-fixed (9 issues). Treat as high-risk during review.

135 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple upload endpoints and tokenless authentication paths were historically missing token requirements, org membership checks, or proper CI verification, allowing unauthorized uploads or data access.

Auth Bypass: Internal API endpoints repeatedly lacked permission filters or used stale/null permission data, exposing private repo data or allowing unauthorized operations like delete/erase.

Auth Bypass: OAuth login flows had multiple bypasses: missing state validation, client-controlled issuer cookies, unvalidated ID tokens, and missing access-token checks, enabling CSRF, account takeover, and auth bypass.