Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

go-task/task

              main @ 385e5ad
            

Fixes

CVEs

CRITICAL

Peak severity

66.7%

Coverage

Highlights

Information Disclosure: 2 prior fixes. Scrutinize any change in this area.

compiler.go: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: Secret variable values were being logged and displayed in summaries, exposing sensitive data to anyone with access to verbose output or summary reports. This is a direct confidentiality breach that can lead to credential theft or unauthorized access to downstream systems.

Information Disclosure: Remote repository URIs containing embedded user credentials (e.g., https://user:pass@host) were printed in error messages and console warnings, leaking secrets to logs and terminal output. This can expose credentials to anyone who can read logs or observe the terminal.

Supply Chain / Integrity Bypass: Cached remote Taskfile content was returned without verifying the pinned checksum, allowing a tampered cache to supply malicious task definitions. This is a supply chain integrity issue that could lead to arbitrary code execution if a cached Taskfile is replaced by an attacker.