Security Hardening
- Path traversal prevention —
/display/overlaydc_path validated against USER_DATA_DIR (null bytes,.., absolute paths blocked) - Theme ID injection —
/themes/web/{theme_id}/downloadregex-validated (alphanumeric only) - Stack trace leakage —
/themes/importno longer exposes internal paths or tracebacks - Download filename sanitization — update handler strips traversal from filenames
- Subprocess safety —
shlex.split()for CLI system commands - PYTHONPATH ordering — sudo re-exec puts site-packages first, dev clone last (#47)
Testing
- 18 dedicated security tests covering path traversal, info leakage, upload limits, input validation
- 4112 total tests passing
Other
- Release trigger words (
patch,minor,major) in CLAUDE.md