Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kuaifan/dootask
pro @ 6c8050f
11
Fixes
0
CVEs
HIGH
Peak severity
44.4%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
app/Http/Controllers/Api/ProjectController.php: most-fixed (3 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes show recurring missing permission checks on task operations, including task relations, updates, and list operations, indicating systemic authorization gaps.
Access Control: A dedicated TASK_TIME permission was introduced to fix an authorization bypass on task time modifications, showing that granular permission enforcement is often missing.
Auth Bypass: Dynamic route dispatch to non-public methods enabled unauthorized access to internal helpers; restricting to public methods is a critical guard.