Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

erp-mafia/accounted

              main @ a5154ee
            

Fixes

CVEs

CRITICAL

Peak severity

15.2%

Coverage

Highlights

Auth Bypass: 36 prior fixes. Scrutinize any change in this area.

Database: most-fixed (7 issues). Treat as high-risk during review.

40 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers could manipulate database queries or exploit missing Row-Level Security policies to execute unauthorized actions, modify records cross-tenant, or take over accounts during identity registration flows. This represents a systemic tenant isolation risk.

SSRF: Webhook dispatch pathways were vulnerable to SSRF and DNS-rebinding attacks, which would allow attackers to proxy arbitrary HTTP requests via the server to internal network assets or metadata endpoints.

SQL Injection: Improperly parameterized DSL filters used in PostgREST queries allowed arbitrary search logic manipulation. Complex or-filters were vulnerable to injection and required manual sanitization or conversion to parallel parameterized checks.