fix: patch command injection, OAuth CSRF, and path deny-list bypass#23

Open

olleepalmer wants to merge 2 commits into

suitedaces:mainfrom

olleepalmer:fix/security-vulnerabilities

Commits on Feb 25, 2026

fix: patch command injection, OAuth CSRF, and path deny-list bypass

olleepalmer
and
claude
committed
fix: path boundary bypass, symlink fallback, and Telegram callback auth

olleepalmer
and
claude
committed