Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

worldcoin/developer-portal

              main @ fdc82ff
            

101

Fixes

CVEs

CRITICAL

Peak severity

36.4%

Coverage

Highlights

Auth Bypass: 49 prior fixes. Scrutinize any change in this area.

hasura/metadata/databases/default/tables/public_app_metadata.yaml: most-fixed (4 issues). Treat as high-risk during review.

79 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Client-supplied session claims (memberships, user fields) were trusted, enabling arbitrary session takeover and mass assignment; fixed by server-side re-derivation and field allowlisting.

Auth Bypass: Integrity JWT verification lacked audience and environment-specific issuer/JWKS validation, allowing acceptance of tokens from wrong environment or audience.

Auth Bypass: Nullifier hash normalization gaps (case/prefix/padding) allowed bypassing uniqueness and verification limits; also signal hash encoding bypass.