| Filename | Latest commit message | Latest commit date |
|---|---|---|
89092caba4
Addresses mara's security review: replace validate_state_filename (which accepted any non-traversal filename) with a tight allowlist containing only the two known credential filenames: forge-token and matrix-token. Also addresses argus review feedback: - drop issue tag from priv_proto.rs doc comment - add comment explaining the path-detection heuristic in forge.rs - add note about create_dir_all uid=0 edge case in write_agent_state_file |
||
| .. | ||
| src | ||
| Cargo.toml | ||