#234: Fix code review findings — 5 HIGH, 8 MEDIUM, 6 LOW severity#247

Merged

JeremyDev87 merged 15 commits into

mainfrom

fix/234-code-review-findings

Feb 16, 2026

Commits on Feb 16, 2026

chore: add .worktrees/ to .gitignore
JeremyDev87
committed
fix(security): reject NONE in authorized_approvers (H3)
JeremyDev87
committed
fix(security): escape labels/author in execute prompt (H2)
JeremyDev87
committed
fix(security): remove untrusted plan comment fallback (H1)
JeremyDev87
committed
fix(security): add newline escaping to escapeForShellArg (M2)
JeremyDev87
committed
fix(security): replace unsafe type casts with type guards (H4, H5)
JeremyDev87
committed
fix(security): register API key and token with core.setSecret (M1)
JeremyDev87
committed
refactor: use path.join and add coverage to ESLint ignores (M6, M12)
JeremyDev87
committed
perf: cache Octokit instances by token (M5)
JeremyDev87
committed
fix: extract magic number, validate parseRepo, restrict temp file perms (L1, L4, L5)
JeremyDev87
committed
style: apply prettier formatting
JeremyDev87
committed
fix(security): validate MODE env var in post_process_cli (E1)
JeremyDev87
committed
fix(security): register GH_TOKEN with core.setSecret in post_process_cli (E2)
JeremyDev87
committed
fix: escape single-quotes, strip control chars, strict parseRepo, cleanup (E3-E6)
JeremyDev87
committed
fix: strict parseRepo validation to reject extra path segments (E4)
JeremyDev87
committed