Security context

Highlights

Auth Bypass: 81 prior fixes. Scrutinize any change in this area.

model/project_ref.go: most-fixed (9 issues). Treat as high-risk during review.

123 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Numerous GraphQL resolvers and mutations lacked permission checks, allowing unauthorized access to tasks, logs, annotations, and project data. Fixes added directives like requireProjectAccess and specific permission checks, but the breadth of affected resolvers suggests systemic gaps.

Information Disclosure: Sensitive credentials like GitHub tokens and private variables were exposed to task environments and logs. Fixes involved redaction (PutAndRedact), excluding tokens from expansions, and separating private variables, but the repeated nature indicates ongoing leakage risks.

Command Injection: Multiple command injection vectors were found where user-controlled input (branch names, commit messages, file paths) was interpolated into shell commands. Fixes involved removing vulnerable commands, using stdin for commit messages, and validating paths, but the pattern of shell construction is risky.