Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

diced/zipline

              trunk @ a2ac5f2
            

Fixes

CVEs

HIGH

Peak severity

47.6%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

src/lib/oauth/withOAuth.ts: most-fixed (2 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Multiple fixes address path traversal via filename/extension overrides and content-range validation, indicating a recurring weakness in file path construction from user input.

Auth Bypass: Multiple OAuth and passkey fixes target session overwrite, allowlist/denylist logic, and authentication implementation, highlighting a fragile authentication surface.

Access Control / IDOR: Multiple fixes enforce ownership checks on file/folder operations, indicating a pattern of missing authorization on user-scoped resources.