CRITICAL: PR #560 security claims FALSE - system() call remains in fortplot_pipe_timeout.c

[krystophny]

BRUTAL AUDIT FINDINGS - SECURITY FAILURE

PR #560 FALSELY CLAIMS: "Zero system() calls remain (all eliminated)"

ACTUAL SECURITY VIOLATION:

• File: src/fortplot_pipe_timeout.c
• Line: 85
• Code: int result = system(command);

Evidence of FALSE CLAIMS

Commit Message LIES:

- Zero execute_command_line calls remain active (all security-hardened)
- Zero system() calls remain (all eliminated)  
- Complete command injection attack surface elimination

ACTUAL GREP RESULTS:

/home/ert/code/fortplot/src/fortplot_pipe_timeout.c:85:    int result = system(command);

Critical Security Impact

1. ACTIVE COMMAND INJECTION VECTOR: system() call accepts unvalidated input
2. SHELL INJECTION VULNERABILITY: External commands executable with arbitrary parameters
3. FRAUDULENT SECURITY CLAIMS: PR documentation contains demonstrably false security assertions

VERDICT: SAVAGE HANDBACK REQUIRED

PR #560 MUST BE REJECTED for:

• False security compliance claims
• Active command injection vulnerabilities
• Systematic lying about implementation status

RESPONSIBLE PARTY: sergei - COMPLETELY FAILED security verification
TRUST IMPACT: CRITICAL - Claims cannot be trusted without independent verification

The security "fix" is INCOMPLETE and DANGEROUS with false documentation.

[krystophny]

DUPLICATE: Consolidating into #576 - Command injection vulnerability in fortplot_pipe_timeout.c. Stop filing duplicates and FIX THE ACTUAL PROBLEM.