Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ilyagr/tangled-core
master @ 8dae47c
15
Fixes
0
CVEs
HIGH
Peak severity
35.7%
Coverage
Highlights
Auth Bypass: 7 prior fixes. Scrutinize any change in this area.
appview/state/middleware.go: most-fixed (2 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple independent authorization flaws: using handle-based identifiers that can be resolved to different DIDs, path-based wildcard matching that allows unauthorized access, and missing HMAC verification on internal endpoints. These represent systemic weaknesses in the authorization model.
Path Traversal: Four separate fixes address path traversal via repo names and branch names used in filesystem paths and URL construction. The repeated occurrence across different components indicates a common failure to validate user input before path building.
Auth Bypass: Repository deletion lacked proper authorization and sequencing, allowing unauthorized deletion or deletion without record cleanup. These fixes highlight the need for both RBAC enforcement and state consistency checks on destructive operations.