mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-10 02:30:39 +01:00
A fresh run refuses a user policy path with a dangling parent link, but verify looked only at the leaf, so the parent's ENOENT read as continued absence and an old defaults pass stayed publishable. The loader and verify now share one absence check. Found by the security review of #3286. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>