Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
slackapi/bolt-js
main @ a687320
7
Fixes
0
CVEs
HIGH
Peak severity
83.3%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
src/receivers/HTTPModuleFunctions.ts: most-fixed (3 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Involuntary bypass of cryptographic signature checks can occur if a null, undefined, or empty signing secret is tolerated during initialization, leading to unauthenticated request acceptance.
Auth Bypass: Weak validation of administrative request bypasses (such as loosely checking query parameters like ssl_check) allows attackers to forge valid Slack events and completely skip signature verification.
CSRF: Incorrect configuration or omission of OAuth state parameters during installation initiation compromises state verification, exposing installers to cross-site request forgery attacks.