fix(pages): harden deployment input shell boundary - #2272

Draft

seonghobae wants to merge 20 commits into

codex/strix-trusted-binder-rootfrom

seonghobae/fix-semgrep-red-gate-central

Commits on Sep 18, 2026

fix(sast): clear the three Semgrep findings that fail every PR here

seonghobae
and
claude
committed
5b9e864
test(security): pin Pages caller-input shell boundary
seonghobae
committed
bb9413a

Commits on Sep 19, 2026

test(security): execute Pages shell-input regression
seonghobae
committed
4967d66
fix(sast): silence Bandit B310 on the same two hardened openers

authored and
seonghobae
committed
ba7f41f
test(sast): cover the codeql opener's origin pin, not just strix's

authored and
seonghobae
committed
e0b6e70
merge: integrate GitHub API redirect authority successor
seonghobae
committed
3923b19
docs(sast): record lossless successor stack
seonghobae
committed
5896e60
merge: carry current GitHub authority evidence into SAST repair
seonghobae
committed
5c71e88
merge: carry current GitHub authority owner into SAST repair
seonghobae
committed
cd3b41b
test(strix): require fixture evidence binder
seonghobae
committed
857e788
fix(strix): materialize evidence binder in fixtures
seonghobae
committed
89cee55
docs(strix): record fixture runtime RCA
seonghobae
committed
1eb03c7
test(strix): require complete isolated fixture runtime
seonghobae
committed
8f66ead
merge: adopt protected main before Strix repair
seonghobae
committed
354692e
fix(strix): restore and close isolated fixture runtime
seonghobae
committed
4e8829f
merge: stack Pages SAST lane on canonical Strix owner
seonghobae
committed
0379535

Commits on Sep 20, 2026