Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

life360-oss/prebid-server

              master @ ac77fec
            

Fixes

CVEs

CRITICAL

Peak severity

72.7%

Coverage

Highlights

Denial of Service: 7 prior fixes. Scrutinize any change in this area.

endpoints/cookie_sync.go: most-fixed (3 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Privilege Escalation / Repo Takeover: CI/CD workflows using pull_request_target with checkout of fork head and write-scoped tokens allow arbitrary code execution and repo takeover; a single misconfiguration is catastrophic.

Denial of Service: Panics in module hooks crash the auction process, and unbuffered channels cause goroutine leaks; both lead to resource exhaustion and service unavailability.

Privacy Bypass: GDPR consent handling is fragile: ambiguous signals are not propagated, aliases bypass consent checks, and personal info can be sent without proper consent, violating user privacy.