[Info] redirect()/streamRedirect() destinations not validated (open-redirect hardening)

[thinkter]

Security audit finding, commit abf4e87. Hardening / documentation issue.

Files: src/core/control.ts:31-33, src/core/render.ts:131-133, src/client/runtime.ts:169

Attack / Failure scenario

redirect() / streamRedirect() destinations are app-controlled and are not validated. If an app passes user-influenced input as the destination, the result is an app-level open redirect (phishing / token-forwarding vector). Because brandy owns these helpers, it is well-placed to provide a safe-by-default posture.

Suggested fix

Hardening + docs:

• Document that external/absolute redirect targets must be validated/allowlisted by the app.
• Optionally reject non-same-origin absolute URLs by default, with an explicit opt-in (e.g. redirect(url, { allowExternal: true })) for intentional cross-origin redirects.