path-traversal

From README

Path Traversal Security Check (A01:2025) What this checks Protects against directory traversal attacks where an attacker uses ../ sequences, absolute paths, or symlinks to access files outside the intended directory. Exploitation leads to reading sensitive files (/etc/passwd, .env, private keys), overwriting configuration, or achieving remote code execution via file write. Vulnerable patterns A caller-supplied filename interpolated or concatenated into a path before opening, with no canonicalization. Path-join helper used as the only defense — these collapse some .. segments but do not verify the final path stays under the intended root, and many treat an absolute caller-supplied path as overriding the base. Existence or stat check on the user path that does not follow symlinks, but the subsequent read/write does — symlink escape. Canonicalization performed once at handler entry, but a later file operation uses the un-canonicalized value.