security: fix 5 CRITICAL + 2 HIGH from 2026-04-19 internal audit#298

Open

mm5srh4ngk-droid wants to merge 6 commits into

KeygraphHQ:mainfrom

mm5srh4ngk-droid:echo/audit-2026-04-19-critical-fixes

Commits on Apr 20, 2026

docs(security): add 2026-04-19 internal CRITICAL audit report
echocystems
committed
fix(security): prevent command injection in container entrypoint
echocystems
committed
fix(security): validate SHANNON_DELIVERABLES_SUBDIR before use
echocystems
committed
fix(security): canonicalise --file-path via realpath to block symlink escapes
echocystems
committed
fix(security): pin router image digest and npm package version

echocystems
and
claude
committed
fix(security): tighten workspace chmod from 0o777 to 0o770 on Linux

echocystems
and
claude
committed