fix: replace create_subprocess_shell

server.py

@@ -156,10 +156,10 @@ async def enable_cors(request, response):
 
 
 async def start_vue_dev_server():
-    await asyncio.create_subprocess_shell(
-        "npm run dev", stdout=sys.stdout, stderr=sys.stderr, cwd=MAGMA_PATH
+    proc = await asyncio.create_subprocess_exec(
+        "npm", "run", "dev", stdout=sys.stdout, stderr=sys.stderr, cwd=MAGMA_PATH
     )
-    logging.info("VueJS development server is live.")
+    logging.info("VueJS development server started (PID %s).", proc.pid)
 
 
 def _get_parser():

tests/security/test_subprocess_exec.py

@@ -0,0 +1,21 @@
+import ast
+from pathlib import Path
+
+
+SERVER_PY = Path(__file__).resolve().parents[2] / 'server.py'
+
+
+def test_no_create_subprocess_shell_in_start_vue():
+    """Verify create_subprocess_shell is not used in start_vue_dev_server."""
+    content = SERVER_PY.read_text(encoding='utf-8')
+    tree = ast.parse(content, filename=str(SERVER_PY))
+    func_node = None
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) and node.name == 'start_vue_dev_server':
+            func_node = node
+            break
+    assert func_node is not None, "start_vue_dev_server function not found in server.py"
+    func_content = ast.get_source_segment(content, func_node)
+    assert func_content is not None, "Could not extract source for start_vue_dev_server"
+    assert 'create_subprocess_shell' not in func_content
+    assert 'create_subprocess_exec' in func_content