Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getsentry/snuba

              master @ 20bd56e
            

Fixes

CVEs

CRITICAL

Peak severity

28.1%

Coverage

Highlights

Auth Bypass: 14 prior fixes. Scrutinize any change in this area.

snuba/admin/auth_roles.py: most-fixed (3 issues). Treat as high-risk during review.

35 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring bypass of admin access controls: hardcoded false membership checks, missing JWT validation, default roles granting migration powers, and fail-open allocation policies.

SQL Injection: Multiple injection points via string-interpolated queries, unescaped column/literal names, and cluster names in admin copy-tables.

Server-Side Request Forgery / Credential Disclosure: Admin tools allowed connections to arbitrary hosts, risking SSRF and credential leakage; fixes added host allowlists and validation.