Security: Fix multiple path traversal and credential injection vulnerabilities

[l3tchupkt]

Security Vulnerability Fixes

Reported by: Lakshmikanthan K (@letchupkt)

Summary

Three security vulnerabilities have been identified and fixed:

1. PR fix(security) : Fix race condition in file write operations (Symlink TOCTOU) #1146 - Symlink race condition in file write operations
2. PR fix(security) : Fix path traversal via malicious .clasp.json srcDir #1145 - Path traversal via malicious .clasp.json configuration
3. PR fix(security) : Restrict credential file path to home directory #1147 - Credential path injection allowing storage outside home directory

Impact

• Arbitrary file writes outside project boundaries
• Filesystem escape via crafted configuration files
• Potential OAuth credential exfiltration

Fixes Applied

All PRs implement defense-in-depth security controls using O_NOFOLLOW, O_EXCL, path resolution validation, and permission hardening.

Testing

• 197 existing tests passing on all branches
• No regressions introduced

---

Credit: Lakshmikanthan K (@l3tchupkt )

[l3tchupkt]

@sqrrrl please review this !!