Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
lnp2pBot/bot
main @ fea8dec
25
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 16 prior fixes. Scrutinize any change in this area.
bot/start.js: most-fixed (5 issues). Treat as high-risk during review.
21 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes target settlement and invoice commands, indicating a high-risk surface where unauthorized users could trigger fund releases or attach invoices to orders they don't own.
Auth Bypass: Validation functions are the gatekeeper for order operations and dispute handling; fixes here correct async mismatches and query structure errors that allowed unauthorized access.
Auth Bypass: Order-taking and critical operations (cancel, fiatSent, release) lacked proper user validation and ban checks, enabling unauthorized state changes.