Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

maybe-finance/maybe

              main @ 77b5469
            

Fixes

CVEs

CRITICAL

Peak severity

20.0%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

app/controllers/account/holdings_controller.rb: most-fixed (1 issue). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authentication Bypass: OAuth2 refresh tokens lacked expiration and validation, allowing indefinite token use.

Access Control / Authorization Bypass: API keys could access endpoints without proper scope-based authorization checks.

Access Control / Authorization Bypass: Holdings were accessible via account-specific scope instead of family-level authorization, allowing cross-account access.