Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

imranr98/obtainium

              main @ 00d545b
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Credential Leak: 1 prior fix. Scrutinize any change in this area.

lib/providers/source_provider.dart: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Improper Certificate Validation: APK downloads rely on an HttpClient without certificate pinning, exposing users to MITM attacks that could substitute malicious binaries.

Credential Leak: Credentials (headers/cookies) are forwarded on cross-origin redirects, risking leakage to untrusted domains and HTTPS-to-HTTP downgrade.

Credential Storage: GitHub/GitLab credentials were moved to plaintext SharedPreferences, enabling local attackers to extract them; this is a regression from secure storage.