Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
oasisprotocol/oasis-wallet-web
master @ 28d695d
12
Fixes
0
CVEs
HIGH
Peak severity
44.4%
Coverage
Highlights
Security Misconfiguration: 4 prior fixes. Scrutinize any change in this area.
internals/getPermissionHeaders.js: most-fixed (4 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Sensitive wallet data (mnemonics, private keys) is at risk of being sent to browser cloud services via spellcheck or persisted by autofill. Two fixes address this, indicating a high-value surface.
Security Misconfiguration: Permissions-Policy header has been modified four times, often loosening restrictions to allow third-party integrations. This increases the attack surface for browser feature abuse.
Command Injection: GitHub context values were interpolated directly into shell commands, enabling injection. Fixed by using environment variables, but other workflows may still be vulnerable.