diegosouzapw 037f4e8d50 fix(security): close remaining CodeQL alerts + document mandatory patterns ...

Fixes the 4 fixable alerts opened in the recent scan and adds enforceable
guardrails so future development follows the same pattern.

Code fixes:
- src/mitm/cert/install.ts: pass certPath/certName/action via exec()'s env
  option instead of string-interpolating them into the bash script
  (CodeQL js/shell-command-injection-from-environment #225)
- scripts/docs/{gen-provider-reference,add-frontmatter,fix-internal-links}:
  escape backslash before other regex/markdown metacharacters
  (CodeQL js/incomplete-sanitization #227, #228, #229)

Documentation (mandatory patterns):
- docs/security/PUBLIC_CREDS.md — embedding public upstream OAuth/Firebase
  identifiers via resolvePublicCred(); never as string literals
- docs/security/ERROR_SANITIZATION.md — routing every error response through
  sanitizeErrorMessage()/buildErrorBody(); never raw err.stack/err.message
- CLAUDE.md: 4 new Hard Rules (#11-#14) + Security section + scenario notes
- AGENTS.md, CONTRIBUTING.md: cross-reference the two new docs
- SECURITY.md: extended Hard Security Rules with the new mandatory patterns
- docs/README.md: index entries pointing to the two new docs

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-14 11:12:14 -03:00

..

COMPLIANCE.md

feat(docs): add YAML frontmatter to all docs (title/version/lastUpdated)

2026-05-13 18:46:05 -03:00

ERROR_SANITIZATION.md

fix(security): close remaining CodeQL alerts + document mandatory patterns

2026-05-14 11:12:14 -03:00

GUARDRAILS.md

feat(docs): add YAML frontmatter to all docs (title/version/lastUpdated)

2026-05-13 18:46:05 -03:00

PUBLIC_CREDS.md

fix(security): close remaining CodeQL alerts + document mandatory patterns

2026-05-14 11:12:14 -03:00

STEALTH_GUIDE.md

feat(docs): add YAML frontmatter to all docs (title/version/lastUpdated)

2026-05-13 18:46:05 -03:00