Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
posthog/posthog-python
main @ 2e7c73b
7
Fixes
0
CVEs
HIGH
Peak severity
42.9%
Coverage
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
posthog/feature_flags.py: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Credential-looking tokens in exception messages and captured strings are sent to PostHog, risking secret leakage. The fix adds per-word secret detection, but other capture paths may not apply the same redaction.
Cross-Caller Data Leak: In-place mutation of shared CallToolResult objects merges conversation handles across unrelated clients, leaking data between sessions. The fix copies objects, but any other code mutating shared MCP results could still leak.
Denial of Service: Unbounded POST body buffering in the stateless session middleware allows memory exhaustion via large requests. The fix bounds buffering to _MAX_SNIFF_BODY, but other request-handling paths may still buffer without limits.