From a827400c2c6ee1008792ab0202e387e4d4eec4c4 Mon Sep 17 00:00:00 2001
From: orbisai0security <mediratta@gmail.com>
Date: Thu, 23 Jul 2026 12:27:24 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 main/files.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/main/files.js b/main/files.js
index 49b5eca8..f582772b 100644
--- a/main/files.js
+++ b/main/files.js
@@ -401,6 +401,10 @@ function parseProjectJsonResponse(response) {
 }
 
 export function fetchProjectJson(projectPath) {
+  const url = new URL(projectPath, window.location.href);
+  if (url.origin !== window.location.origin && url.protocol !== "https:") {
+    throw new Error("External project URLs must use HTTPS");
+  }
   return fetch(projectPath).then(parseProjectJsonResponse);
 }