Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hyperdxio/hyperdx

              main @ 73e6e87
            

Fixes

CVEs

HIGH

Peak severity

19.4%

Coverage

Highlights

Denial of Service: 16 prior fixes. Scrutinize any change in this area.

packages/api/src/api-app.ts: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Unbounded database query lookback windows and unhandled failures in Handlebars compilation tasks have historically allowed malformed alert rules or large time scopes to crash background worker services.

SQL Injection: Direct string manipulations, lack of proper single-quote escaping inside ClickHouse map subscripts, and unescaped double quotes inside metric value alias queries allow raw SQL parameter manipulation.

Auth Bypass: Misconfigured route middleware placement can lead to authorization bypasses when sub-routers fail to inherit authentication checks uniformly.