fix: address HIGH security findings (HIGH-01 to HIGH-05)#13

Open

manni07 wants to merge 17 commits intomaderix:mainfrom

manni07:fix/high-security-findings

Commits on Mar 2, 2026

chore: add .gitignore with worktrees/ and build artifacts

manni07
and
claude
committed
fix: address CRIT security findings (CRIT-01 to CRIT-04)
manni07
committed
fix: address MED security findings (MED-01 to MED-06)

manni07
and
claude
committed
docs: add HIGH security findings implementation plan

manni07
and
claude
committed
fix(HIGH-01): add token-count guard and embed_lookup bounds check
manni07
committed
docs: update diary #001 with HIGH-01 implementation summary

manni07
and
claude
committed
fix(HIGH-01): add embed_backward clamp and cleanup on early-exit
manni07
committed
fix(HIGH-02): add realpath() validation for data and model paths
manni07
committed
fix(HIGH-03): clean up FD/mmap and resolve argv[0] before exec restart
manni07
committed
docs: update diary with HIGH-03 implementation details
manni07
committed
fix(HIGH-04): add xmf/xcf OOM-abort helpers, replace all malloc/calloc

manni07
and
claude
committed
docs: update diary #001 with HIGH-04 implementation summary

manni07
and
claude
committed
fix(HIGH-04): replace remaining malloc/calloc in stories_cpu_ops.h
manni07
committed
fix(HIGH-04): add OOM guards for remaining malloc/calloc in 3 files

manni07
and
claude
committed
fix(HIGH-04): add OOM guard for mask calloc in stories_mil.h
manni07
committed
fix(HIGH-05): ane_eval() returns bool, add step_ok tracking

manni07
and
claude
committed
docs: mark HIGH-01 to HIGH-05 as resolved, update diary
manni07
committed