Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mondoohq/cnspec
main @ 3574a6f
21
Fixes
0
CVEs
HIGH
Peak severity
47.1%
Coverage
Highlights
Security Misconfiguration: 5 prior fixes. Scrutinize any change in this area.
content/mondoo-aws-security.mql.yaml: most-fixed (3 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Security Misconfiguration Detection Bypass: Multiple fixes in the same file address the same root cause: checks only caught the 0.0.0.0 wildcard bind, missing other routable addresses like listen_address, and did not require loopback. This is a classic fail-open detection gap.
Security Misconfiguration: Two fixes in this file show a pattern of incomplete HCL/terraform checks: one missed absent port ranges, another missed attribute-list and standalone rule forms, IPv6 CIDRs, and NACL rules. These are bypasses where valid misconfigurations evade detection.
Supply Chain Attack: The CI pipeline has been hardened against supply-chain attacks by pinning actions to immutable SHAs and replacing long-lived credentials with short-lived tokens. This is a critical surface for a security product.