Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

neondatabase/neon

              main @ 8f60b04
            

200

Fixes

CVEs

CRITICAL

Peak severity

31.3%

Coverage

Highlights

Denial of Service: 65 prior fixes. Scrutinize any change in this area.

pageserver/src/tenant/timeline.rs: most-fixed (15 issues). Treat as high-risk during review.

100 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypach: Multiple critical authentication bypasses in the proxy's auth backend, including missing JWT audience/expiry checks, unvalidated passwords, and SNI/database name confusion, indicating a fragile trust boundary.

: Numerous DoS fixes in the pageserver tenant/timeline layer, including unbounded memory, panics on malformed input, and missing backpressure, showing that resource exhaustion and crash-triggering inputs are a top concern.

: Fixes removing feature-gated and loopback-based authorization bypass in compute_ctl middleware indicate a history of overly permissive access control that could allow unauthorized configuration changes.