fix(security): harden sandbox — shell escape bypass, symlink TOCTOU, SSRF, working_dir validation#331

Closed

AlexanderGalkin95 wants to merge 6 commits intosipeed:mainfrom

AlexanderGalkin95:main

Commits on Feb 16, 2026

fix(security): harden shell denylist, block metachar escapes, deny-by-default ACL

AlexanderGalkin95
and
claude
committed
fix(security): add SSRF protection to WebFetchTool, warn on plaintext HTTP in provider

AlexanderGalkin95
and
claude
committed
docs: add SSRF protection and TLS warning sections to README

AlexanderGalkin95
and
claude
committed
fix(security): block shell escape bypasses, symlink TOCTOU, and working_dir escape

AlexanderGalkin95
and
claude
committed
Merge pull request #1 from AlexanderGalkin95/fix/security-escape-symlink-workdir
AlexanderGalkin95
authored
chore: add .claude/ to .gitignore

AlexanderGalkin95
and
claude
committed