AI codebase review

fix: sanitise snapshot follow mode; least-privilege CI token

The scan-info view printed the snapshot's "follow" metadata string
unsanitised (the canvas filter was the only defence). The CI workflow
ran with the repository's default GITHUB_TOKEN permissions; it only
needs to read the code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This commit is contained in:

Andy Dixon

2026-10-02 10:59:54 +01:00

co-authored by

Claude Opus 5.5

parent 5966fdd91e

commit 3264def658

2 changed files with 3 additions and 1 deletions

									
										.github/workflows/ci.yml
									
		+2
		
												View File
												
				@@ -2,6 +2,8 @@ name: ci

				on:

				  push:

				  pull_request:

				permissions:

				  contents: read

				jobs:

				  test:

				    strategy: