fix(security): close the remaining triage advisories - #511

Merged

lindesvard merged 5 commits into

mainfrom

fix/security-triage-remaining

Sep 22, 2026

Commits on Sep 22, 2026

fix(security): close webhook template sandbox escape and share password bypass

lindesvard
and
claude
committed
d1b54f7
fix(js-runtime): allowlist the template language and run it in an isolated context

lindesvard
and
claude
committed
abe17c5
test(js-runtime): build the placeholder-key fixture without a template literal

lindesvard
and
claude
committed
7c952c0
fix(js-runtime): refuse writes to globals and stray arrows, count output in bytes

lindesvard
and
claude
committed
f6aebb9
fix(security): close the remaining triage advisories

lindesvard
and
claude
committed
466d543