Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lmvdz/coven

              main @ 5720d1d
            

Fixes

CVEs

HIGH

Peak severity

35.3%

Coverage

Highlights

Auth Bypass: 10 prior fixes. Scrutinize any change in this area.

crates/coven-cli/src/daemon.rs: most-fixed (7 issues). Treat as high-risk during review.

31 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Multiple fixes address user-supplied prompt/model text being interpreted by cmd.exe or harness argv, indicating a persistent injection surface with platform-specific escaping gaps.

Auth Bypass: The daemon exposes multiple IPC transports (named pipe, TCP, Unix socket) that have each required authentication or ACL hardening, suggesting a broad local attack surface with inconsistent enforcement.

Path Traversal / Symlink Attack: Atomic write staging repeatedly vulnerable to symlink swaps and TOCTOU races, requiring randomized paths and exclusive creation to prevent writes outside intended directories.