Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
doctolib/neurow
main @ 307aee2
3
Fixes
0
CVEs
MEDIUM
Peak severity
0.0%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
neurow/lib/neurow/public_api/endpoint.ex: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Active Server-Sent Events (SSE) connections were allowed to persist indefinitely even after the client's authenticating JWT token had expired, bypassing subsequent authorization controls. Ensure that the event loop actively monitors token expiration and terminates the connection when the token is no longer valid.
CORS Misconfiguration: Permissive CORS preflight handling could allow unauthorized origins to make API requests. Restricting preflight checks to an explicit origin allowlist is crucial to prevent unauthorized cross-origin access to public API boundaries.
Information Disclosure: Internal server details, such as backend node names, were leaked via SSE response headers. Outgoing HTTP headers must be stripped of any environment-specific metadata to prevent attackers from mapping the internal topology.