Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
shopperlabs/shopper
2.x @ bb975d0
27
Fixes
5
CVEs
CRITICAL
Peak severity
29.2%
Coverage
Highlights
Auth Bypass: 18 prior fixes. Scrutinize any change in this area.
packages/admin/src/Livewire: most-fixed (3 issues). Treat as high-risk during review.
15 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The application extensively utilizes Livewire and Filament, where multiple state-mutating actions previously failed to enforce backend permission checks, allowing lower-privileged authenticated panel users to mutate product data, toggle settings, or trigger administrative actions. Developers should ensure all actions execute inside authorized controllers or use explicit permission gates.
IDOR: Public Eloquent model properties in Livewire components were vulnerable to manipulation via client-side requests, allowing attackers to access and mutate unauthorized model records. Utilizing the Livewire `#[Locked]` attribute is essential to bind parameters securely.
Race Condition: Concurrent checkout operations permitted race conditions that bypassed discount usage limits and compromised stock reservation limits. Operations that mutate stock and validate coupon usage must be locked atomically.