Harden GitHub security scan findings

[Maneek21]

Summary

• address all 40 originally open CodeQL alert locations through shared parser, exact-match, command-boundary, path/log, identity, socket-filter, and validation fixes
• patch all 17 currently open Dependabot dependency branches and add a scheduled/push/PR low-severity dependency audit
• harden recap, cross-reference, reminder, clip, task, wiki, and agent-employee authorization/privacy boundaries
• add upgrade 0.2.0-preview.4 to redact historical cached excerpts, reminders/notifications, and restricted-task-derived clip summaries
• align Node/pnpm across CI and Docker, make image installs cache-assisted/retry-resumable, enforce LF for the Alpine entrypoint, and remove the pnpm Corepack image vulnerability
• add the detailed security report and remediation plan

Root cause

The GitHub inventory combined repeated rich-text sanitization patterns, test/audit substring checks, unsafe command/path/log construction, vulnerable transitive dependencies, and several authorization/privacy gaps discovered during manual review. The patch fixes shared root causes instead of applying alert-by-alert suppressions.

Validation

• all nine latest-head GitHub checks pass
• branch-specific GitHub CodeQL query: 0 open alerts
• frozen pnpm 11.10.0 install
• full and production pnpm audit --audit-level low: 0 advisories
• API and web typechecks; web lint
• Next.js 16.3.0 production builds on host and Linux/Alpine: 40/40 pages
• 63/63 focused parser/audit/path/reset/upgrade tests
• 19/19 DB-backed authorization/privacy tests on disposable PostgreSQL 16 + pgvector 0.8.2
• 8/8 direct migration redaction/preservation assertions inside a rolled-back transaction
• production image runtime: API health 200, web login 200, Next image optimizer 200 PNG
• Sharp 0.35.3/libvips 8.18.3 native transform
• authenticated Socket.IO connections over forced polling and forced WebSocket
• Trivy 0.70.0 critical-only production-image scan: 0 critical findings
• final 73-file diff review: no P0-P2 regression and no unrelated user files

Deployment

Supported upgrades must apply the new historical-redaction migration with:

pnpm db:upgrade

For a self-hosted deployment, use the backup-first wrapper:

pnpm selfhost:upgrade --prod --compose-file compose.demo.yml

Do not use raw drizzle-kit push, db:push-full, or db:migrate for a supported upgrade.

Scanner closure

The remediation branch reports 0 open CodeQL alerts. Unchanged master still reports 40 CodeQL and 17 Dependabot alerts until this PR merges and GitHub refreshes the default-branch analyses and dependency graph. No alert was dismissed.

Operational notes

• Docker builds require a BuildKit-capable builder.
• The 300-second pnpm fetch timeout can delay reporting a hard registry failure.
• The low-severity audit job is intentionally sensitive to registry availability and newly published advisories.