Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

makenotion/lore

              main @ 95c3558
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

Credential Exposure: 2 prior fixes. Scrutinize any change in this area.

src/config.ts: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Credential Exposure: Bearer tokens were forwarded to child processes, risking leakage to hooks and schedulers. Fix dropped env vars when using ntn-auth-json.

Credential Exposure: Deprecated auth.token in config could silently leak into committed files; warning made non-silenceable.

Credential Theft / SSRF: auth.baseUrl from .lore.yaml could redirect API calls to exfiltrate bearer tokens; now ignored on high-priority auth paths.