Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lmvdz/coven-cave

              main @ 6fbacc8
            

243

Fixes

CVEs

CRITICAL

Peak severity

54.5%

Coverage

Highlights

Auth Bypass: 60 prior fixes. Scrutinize any change in this area.

src/app/api/chat/send/route.ts: most-fixed (24 issues). Treat as high-risk during review.

176 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The chat launch endpoint is the most-fixed file, with repeated bypasses via projectless generation, read-only permission mode, resume target, and malformed Hermes bindings. A single missed check allows unauthorized project access or sandbox downgrade.

Path Traversal: Multiple fixes narrow the project root allowlist and canonicalize paths, but the high count (41 total) and repeated symlink/tilde/realpath escapes indicate the allowlist is a fragile invariant with many bypass variants.

Command Injection: Repeated option injection via dash-prefixed prompt/resumeSessionId and unsafe shell shims on Windows; the fix pattern is to pass input via stdin, add '--', and validate args, but each new subprocess path is a new risk.