Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mozilla/fx-private-relay

              main @ 5eba2ed
            

Fixes

CVEs

CRITICAL

Peak severity

40.0%

Coverage

Highlights

Auth Bypass: 12 prior fixes. Scrutinize any change in this area.

api/authentication.py: most-fixed (3 issues). Treat as high-risk during review.

20 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple critical authentication bypasses stem from framework misconfiguration (DRF permission typo), missing OAuth scope enforcement, and session cookie leakage during social login. These allow unauthenticated access to sensitive user data and protected endpoints.

Signature Verification Bypass: SNS message signature verification was commented out and later restored, indicating a pattern of disabling or missing cryptographic checks on inbound webhooks. Forged SNS notifications could trigger email processing.

Improper Authentication: The inbound_sms endpoint lacked Twilio request signature validation, allowing attackers to forge SMS relay requests. This is a critical missing verification on an external callback.