Lucas Berger 59e49ec3da chore(16-03): triage eslint-plugin-security findings to green ...

- Disable detect-object-injection globally in eslint.config.js: all hits were
  numeric loop array indices (ranks[i]) — not user-controlled keys; zod guards
  real API input boundaries; justification comment added (T-16-09)
- Add inline eslint-disable for detect-non-literal-fs-filename at 2 sites:
  - apps/api/src/index.ts: realpathSync(process.argv[1]) — runtime entry path, not user input
  - apps/api/tests/broker/expand.test.ts: readFileSync of test fixture path — test-controlled
- pnpm lint exits 0 across both apps with --max-warnings 0
- 14 of 15 security rules remain active at error; no blanket file disables

2026-06-13 05:24:02 -04:00

..

api

chore(16-03): triage eslint-plugin-security findings to green

2026-06-13 05:24:02 -04:00

pwa

feat(15-01): fix 13 markdown violations + wire md:lint to fast-checks CI step

2026-06-12 10:46:01 -04:00