Security context

Highlights

Information Disclosure: 1 prior fix. Scrutinize any change in this area.

src/app/api/proxy/route.ts: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

SSRF: POST handler performed fetch(target) with insufficient validation, allowing attackers to probe internal services.

Path Traversal: writeWidgetFile/readWidgetFile used paths from the bash tool without stripping sandbox prefixes, enabling arbitrary file writes/reads.

Information Disclosure: fetch(target) forwarded requests without Authorization header, leaking credentials and enabling cross-user cache poisoning.