Token storage permission checks and path traversal mitigation - #80

Open

pturbing wants to merge 3 commits into

mainfrom

pascal/sec-hardening

Commits on Sep 18, 2026

Create parent directories with 0700 instead of 0777, since Go applies

pturbing
and
claude
committed
ddbb5cb
A bare relative cluster value (e.g. "../../etc/passwd") parses into

pturbing
and
claude
committed
147551d
Pin github action refernces to commit SHAs instead of mutable tags
pturbing
committed
a0d2889