Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

diggerhq/digger

              develop @ 3053cda
            

Fixes

CVEs

CRITICAL

Peak severity

37.5%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

backend/middleware/basic.go: most-fixed (2 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple critical auth bypasses were fixed in this component, including missing signed URL verification and JWT-only enforcement, indicating a systemic weakness in API authentication.

Auth Bypass: Two separate fixes in the basic auth middleware show that token validation was incomplete and access levels were not properly set, leaving room for bypasses.

Access Control: Policy lookup priority and missing-policy handling were flawed, allowing org-level deny policies to be skipped or misapplied, constituting an access control bypass.