Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mendableai/firecrawl
main @ 84d7362
72
Fixes
1
CVEs
CRITICAL
Peak severity
56.8%
Coverage
Highlights
Denial of Service: 26 prior fixes. Scrutinize any change in this area.
apps/api/src/controllers/auth.ts: most-fixed (12 issues). Treat as high-risk during review.
30 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
SSRF: The scraping engine resolves user-provided URLs and handles redirects, historically suffering from custom validation bypasses. Utilizing strict validation engines like ipaddr.js and secure network dispatchers is required to block private, loopback, and local network segments.
Information Disclosure: SDK HTTP clients handling pagination sequentially forwarded sensitive Authorization bearer headers to absolute next-page target URLs without validating that the target host matched the API's configured base URL, risking credential leakage.
Auth Bypass: API authorization checks have historically been bypassed due to caching errors (parsing key strings instead of actual cached values), weak environment flag evaluation, and dynamic price/plan matching issues.