Found while dogfooding the current source.
CreateInstallerProcessStartInfo launches the installer with:
Evidence: src/CodeIndex/Cli/ProgramRunner.cs:3195
For a security-sensitive self-update path, resolving bash through the ambient PATH is weaker than using a trusted absolute path or validating the resolved executable.
Expected: use a known shell path where possible, validate the resolved executable, or document and test the intended trust boundary for PATH-based shell resolution.
Found while dogfooding the current source.
CreateInstallerProcessStartInfolaunches the installer with:Evidence:
src/CodeIndex/Cli/ProgramRunner.cs:3195For a security-sensitive self-update path, resolving
bashthrough the ambientPATHis weaker than using a trusted absolute path or validating the resolved executable.Expected: use a known shell path where possible, validate the resolved executable, or document and test the intended trust boundary for PATH-based shell resolution.