TPTBusiness 5f735adcb1 fix(security): resolve CodeQL path-injection and clear-text-logging alerts ...

Path injection (#37, #39, #40):
- _safe_resolve() in app.py: return safe_root / candidate.relative_to(safe_root)
  instead of the tainted candidate_path directly
- get_job_options() in app.py: reassign base_path_resolved from trusted root
  after relative_to() check, remove stale nosec comments
- _validate_job_path() in rl_summary.py: return root-derived path and omit
  resolved_job from the error message to avoid information leakage

Clear-text logging (#38):
- eurusd_llm.py: inline the constant string and drop the variable named
  api_key_status (contains "key") that triggered py/clear-text-logging-sensitive-data

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-17 21:51:35 +02:00

..

CoSTEER

feat: Fast mode - CoSTEER goes to backtest after 1 iteration

2026-04-04 20:52:39 +02:00

data_science

fix: Add Bandit security scanning and fix critical vulnerabilities

2026-04-03 11:55:05 +02:00

factor_coder

fix(security): resolve CodeQL path-injection and clear-text-logging alerts

2026-04-17 21:51:35 +02:00

finetune

feat: add LLM-finetune scenario (#1314)

2026-03-02 19:04:10 +08:00

model_coder

chore: initial Predix state (RD-Agent fork + EURUSD setup)

2026-03-22 21:20:02 +01:00

rl

feat: Full system integration - RL + Protections + Backtesting + CLI

2026-04-03 13:53:32 +02:00