Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

supabase/gotrue

              master @ 7691e96
            

114

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 73 prior fixes. Scrutinize any change in this area.

api/token.go: most-fixed (9 issues). Treat as high-risk during review.

75 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Refresh token rotation and session validity checks were repeatedly patched, indicating a high-risk area for token replay and indefinite session reuse.

Auth Bypass: Multiple fixes addressed verification token reuse, flow-state expiry, and type-specific lookups, showing a complex attack surface where bypasses can occur through token hash reuse or mismatched flow states.

Auth Bypass: OAuth and external provider callbacks had several fixes for unverified email handling, identity linking, and state forgery, indicating a high-risk area for account takeover.