Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

safe-global/safe-wallet-web

              dev @ b20665c
            

Fixes

CVEs

HIGH

Peak severity

35.1%

Coverage

Highlights

Auth Bypass: 8 prior fixes. Scrutinize any change in this area.

.github/workflows/storybook-screenshots.yml: most-fixed (2 issues). Treat as high-risk during review.

40 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authorization Bypass: Multiple fixes target unauthorized signing/execution by non-owners or through blind signing, indicating a persistent weakness in validating the actor and payload before cryptographic operations.

Auth Bypass: Several fixes address permission bypasses via stale state, missing expiry checks, or URL normalization, showing a pattern of incomplete authorization checks across different features.

Command Injection: Three separate fixes in CI workflows address shell injection via direct interpolation of untrusted inputs, indicating a systemic issue in how workflow inputs are handled.