rUv 75fe9f564f fix: address security audit findings from #1375 (#1383) ...

1. SQL injection: Convert all 9 string-interpolated queries in
   memory-initializer.ts to parameterized queries (db.prepare/bind)
   Closes #1030

2. Preinstall hook: Remove no-op preinstall script and package.json entry
   that triggered supply chain concern

3. SECURITY.md: Add vulnerability disclosure policy with supported
   versions, reporting process, and safe harbor statement

4. SafeExecutor: Remove npx from default command allowlist to prevent
   arbitrary package execution via safe executor

5. Cleanup command: Add `cleanup` command for removing project artifacts
   (.claude/, .swarm/, data/, etc.) with --dry-run default and --force
   to execute. Addresses uninstall documentation gap

Published as v3.5.40. All fixes verified in Docker.

Closes #1375

2026-03-19 11:25:54 -04:00

..

security-compliance.test.ts

fix: address security audit findings from #1375 (#1383)

2026-03-19 11:25:54 -04:00