Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hummingbot/gateway

              main @ f090f4a
            

Fixes

CVEs

CRITICAL

Peak severity

37.5%

Coverage

Highlights

Information Disclosure: 5 prior fixes. Scrutinize any change in this area.

src/chains/solana/solana.ts: most-fixed (3 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes were needed to gate fund-moving /trading/* and /restart routes behind authentication, indicating a systemic weakness in route protection. The loopback-binding default and opt-in token auth in app.ts complement the sensitive-path regex in gateway-security.ts, but any new route handling wallet operations must inherit these guards.

Path Traversal: Three separate fixes address directory traversal in wallet/token file reads, showing a repeated pattern of unsanitized address/chain/network values being concatenated into file paths. The fixes introduce address format validation and safe path utilities, but every new file-read path must consistently apply these checks.

Information Disclosure: Five fixes address leakage of API keys and RPC/WebSocket URLs in logs. The redactUrl() utility is the central defense, but its use is inconsistent across components; any new logging of URLs or connection strings must invoke redaction or omit sensitive fields entirely.