2 Commits

Author SHA1 Message Date
opencode
496ac5ec7c fix: prevent command injection via shell=True (issue #1, #3)
- Replace shell=True with shell=False + shlex.split()
- Add command whitelist to restrict allowed executables
- Parse commands safely to prevent metacharacter injection (;, &&, |, backticks)
2026-07-05 07:00:29 +00:00
Jarian Cottingham
7e8d31af6e Clover created 2026-01-13 00:07:41 -06:00