Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

qwibitai/nanoclaw

              main @ 294ef2a
            

Fixes

CVEs

HIGH

Peak severity

10.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

src/container-runner.ts: most-fixed (3 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Two separate bypasses allowed cross-group resource access via CLI commands and IPC task operations, indicating a systemic lack of group-scope enforcement across host-side interfaces.

Path Traversal: Multiple traversal fixes across session outbox file operations, group folder resolution, and container mounts show a pattern of insufficient path containment when handling user-controlled folder names or file paths.

Credential Exposure: Secrets were exposed via container env vars, proxy binding, and .env file visibility inside the container, indicating a recurring failure to isolate credentials from the agent runtime.