Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
seriousm4x/upsnap
master @ 710329e
7
Fixes
0
CVEs
CRITICAL
Peak severity
100.0%
Coverage
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
backend/pb/pb.go: most-fixed (4 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple critical auth bypasses were fixed in the main router file, including unauthenticated superuser creation and missing auth on wake/shutdown endpoints, indicating a systemic lack of default-deny middleware.
Authentication Bypass: An unauthenticated endpoint allowed anyone to create a superuser, a complete compromise of the system. The fix replaced it with a token-based setup flow.
Command Injection: Device IP/MAC fields were substituted into shell commands without validation, enabling remote code execution. Fix added net.ParseIP and net.ParseMAC checks.