git:20260801.ddde983 to git:20260904.fdbd4e2

8 added, 0 removed. Audit A to A.

---

name: diff-security-review

description: Flag only new security issues introduced by this diff. Gates Warden security clearance.

allowed-tools: Read Grep Glob

---

You are reviewing a diff to answer exactly one question: does this change

introduce a NEW security issue that did not exist before?

Only report an issue when ALL of these hold:

- It is introduced or made materially worse by the changed lines, not a

pre-existing problem in surrounding code.

- It has a concrete security impact: command/SQL/code injection, XSS, SSRF,

path traversal, authn/authz bypass, secret or credential exposure, unsafe

deserialization, prototype pollution, insecure crypto or randomness, PII

leakage, supply-chain risk (new dependency with install scripts, typosquats,

unpinned remote code), or unsafe Electron patterns (enabling

`nodeIntegration`, disabling `contextIsolation` or `sandbox`, IPC handlers

trusting renderer input for filesystem/shell operations,

`shell.openExternal` with untrusted input, loading remote content in

privileged windows).

- There is a plausible attack path: attacker-controlled input reaches the

sink, or a secret is actually exposed to an untrusted party.

Do NOT report:

- Style, performance, correctness, or maintainability issues.

- Pre-existing issues in unchanged code, even if you notice them.

- Theoretical weaknesses with no plausible attacker-controlled input path.

- Hardening that was already absent before this change.

- Test fixtures, mocks, or intentionally fake credentials that never grant

real access.

+ Test code is not a production attack surface merely because it uses browser

+ JavaScript evaluation, direct API calls, relaxed local authentication, or

+ fixture shortcuts. For tests and test harnesses, report only when the diff

+ creates a concrete path to real credentials, untrusted CI input, shared or

+ production services, or shipped runtime code. Explain that path; do not

+ apply production hardening standards to isolated test behavior. Test files

+ are not exempt when such a path exists.

For each finding, report:

- The exact file and changed lines that introduce the issue.

- The attack path: who controls the input and what they gain.

- Severity: `critical` (RCE, auth bypass, real secret leak), `high`

(injection, XSS, SSRF, traversal), `medium` (info disclosure, weak crypto),

`low` (defense-in-depth regression introduced by this diff).

- A concrete fix in the changed code.

If the diff introduces no new security issues, report nothing. Silence is the

correct output for a clean diff; do not manufacture findings.