Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

oblien/openship

              main @ fcadb4a
            

Fixes

CVEs

HIGH

Peak severity

26.7%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

.dockerignore: most-fixed (1 issue). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Broken Access Control / Tenant Confusion: Terminal WebSocket upgrade resolved organization from user memberships instead of the ticket's org, allowing cross-tenant access.

Improper Access Control: Registry credential resolver was not bound to a specific organization at injection time, enabling cross-tenant credential resolution.

Auth Bypass: DNS credential write routes lacked admin role checks, allowing any member to modify org-wide credentials.