Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

stripe/stripe-ruby

              master @ 18ecc12
            

Fixes

CVEs

CRITICAL

Peak severity

77.8%

Coverage

Highlights

Resource Exhaustion / DoS: 2 prior fixes. Scrutinize any change in this area.

.github/workflows/ci.yml: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Execution: Unsafe Ruby Marshal deserialization allows arbitrary code execution from crafted serialized data; replaced with explicit deep_copy.

Auth Bypass: Allowing API key override with client_secret can bypass authentication; must enforce strict credential separation.

Response Confusion / Connection Reuse: Interrupted requests leave stale responses that can be misattributed; requires discarding connections on exceptions.