Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getsentry/sentry

              master @ bd91f5d
            

244

Fixes

CVEs

CRITICAL

Peak severity

28.2%

Coverage

Highlights

Auth Bypass: 100 prior fixes. Scrutinize any change in this area.

src/sentry/auth/helper.py: most-fixed (5 issues). Treat as high-risk during review.

72 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: SSO identity resolution prioritized identity provider claims over active user sessions, creating a risk of account hijacking during account linking. This was resolved by forcing authentication state validation before merging accounts.

Insecure Direct Object Reference (IDOR): A missing project-level and organization-level boundary check allowed event data leakage across organizations via direct event queries. Fixes applied strict organization-scoped query filtering.

Denial of Service: Catastrophic backtracking (ReDoS) in grouping parameterization regular expressions allowed remote attackers to exhaust CPU resources. It was resolved by capping maximum input lengths and bounded repeating quantifiers.