garrytan and capy-ai[bot]
660484ee99
security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml
...
Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a
cwd bunfig.toml preload before the program starts. gstack runs inside the repo
it audits, so a committed .env could steer state roots, the claude binary or
spend caps, and a bunfig preload ran arbitrary code in every bin and hook.
Every bun shebang, shell and skill caller, TypeScript spawn and compiled build
now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(),
--no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture
regressions.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
2026-10-19 20:48:49 +00:00
..
2026-10-01 11:57:48 -07:00
2026-03-26 11:15:24 -06:00
2026-09-26 18:57:53 -04:00
2026-08-29 09:06:54 -07:00
2026-05-07 20:14:59 -07:00
2026-05-09 08:06:47 -07:00
2026-09-01 11:15:11 -07:00
2026-05-13 12:22:30 -04:00
2026-09-29 08:58:49 -07:00
2026-08-29 09:06:54 -07:00
2026-04-28 20:08:04 -07:00
2026-08-16 19:34:41 -07:00
2026-04-28 20:08:04 -07:00
2026-05-14 21:46:50 -07:00
2026-10-05 01:29:54 +00:00
2026-10-11 15:56:22 +00:00
2026-10-03 07:54:09 -07:00
2026-08-19 11:42:55 -07:00
2026-08-15 11:42:19 -07:00
2026-08-19 11:42:55 -07:00
2026-08-29 09:06:54 -07:00
2026-05-27 16:09:38 -07:00
2026-04-28 20:08:04 -07:00
2026-08-14 22:02:07 -07:00
2026-10-04 07:58:41 -07:00
2026-05-01 07:21:28 -07:00
2026-10-06 23:42:19 +00:00
2026-10-06 23:42:19 +00:00
2026-09-01 11:15:11 -07:00
2026-10-04 07:58:41 -07:00
2026-05-21 21:21:07 -07:00
2026-08-14 22:02:07 -07:00
2026-10-01 13:55:16 -07:00
2026-10-08 17:40:06 +00:00
2026-10-05 01:29:54 +00:00
2026-10-04 07:58:41 -07:00
2026-10-05 01:29:54 +00:00
2026-10-05 01:29:54 +00:00
2026-09-25 12:06:45 -04:00
2026-09-25 12:06:45 -04:00
2026-09-25 12:06:45 -04:00
2026-08-29 10:10:35 -07:00
2026-10-06 18:07:50 +00:00
2026-10-06 18:07:50 +00:00
2026-09-25 12:06:45 -04:00
2026-09-28 13:09:52 -07:00
2026-09-28 13:09:52 -07:00
2026-09-28 13:09:52 -07:00
2026-09-25 12:06:45 -04:00
2026-09-25 12:06:45 -04:00
2026-09-25 12:06:45 -04:00
2026-09-25 12:06:45 -04:00
2026-09-25 12:06:45 -04:00
2026-09-25 12:06:45 -04:00
2026-08-16 19:34:41 -07:00
2026-05-07 20:14:59 -07:00
2026-04-08 00:41:55 -07:00
2026-09-25 12:06:45 -04:00
2026-10-06 18:07:50 +00:00
2026-10-01 13:55:16 -07:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-10-04 07:58:41 -07:00
2026-10-03 07:54:09 -07:00
2026-04-18 23:25:33 +08:00
2026-04-10 17:13:15 -10:00
2026-10-07 23:29:05 +00:00
2026-10-04 07:58:41 -07:00
2026-03-26 11:15:24 -06:00
2026-10-03 07:54:09 -07:00
2026-08-29 09:06:54 -07:00
2026-05-20 07:35:01 -07:00
2026-09-24 01:53:58 -04:00
2026-04-21 21:58:27 -07:00
2026-08-31 08:55:30 -07:00
2026-10-05 01:29:54 +00:00
2026-10-04 07:58:41 -07:00
2026-10-06 18:07:50 +00:00
2026-10-04 07:58:41 -07:00
2026-10-04 07:58:41 -07:00
2026-10-19 20:48:49 +00:00
2026-08-29 09:06:54 -07:00
2026-09-29 08:58:49 -07:00
2026-10-04 07:58:41 -07:00
2026-10-06 18:07:50 +00:00
2026-10-04 07:58:41 -07:00
2026-09-22 14:57:52 -04:00
2026-10-01 11:57:48 -07:00
2026-09-22 14:57:52 -04:00
2026-10-11 15:56:22 +00:00
2026-10-04 07:58:41 -07:00
2026-04-20 13:20:30 +08:00
2026-03-20 12:22:11 -07:00
2026-08-16 19:34:41 -07:00
2026-08-15 11:42:19 -07:00
2026-09-23 08:54:53 -04:00
2026-05-07 20:14:59 -07:00
2026-10-11 15:56:22 +00:00
2026-10-11 15:56:22 +00:00
2026-05-07 20:14:59 -07:00
2026-10-01 11:57:48 -07:00
2026-05-24 01:43:51 -07:00
2026-08-15 11:42:19 -07:00
2026-09-14 15:14:58 -07:00
2026-05-30 14:57:07 -07:00
2026-10-01 11:57:48 -07:00
2026-10-06 23:42:19 +00:00
2026-05-14 21:46:50 -07:00
2026-05-20 07:35:01 -07:00
2026-08-15 09:37:04 -07:00
2026-04-23 10:23:40 -07:00
2026-09-29 08:58:49 -07:00
2026-08-15 22:20:30 -07:00
2026-05-20 06:56:41 -07:00
2026-08-15 09:37:04 -07:00
2026-04-23 10:23:40 -07:00
2026-08-29 09:06:54 -07:00
2026-05-20 07:35:01 -07:00
2026-10-05 01:29:54 +00:00
2026-10-01 13:55:16 -07:00
2026-09-23 08:54:53 -04:00
2026-10-03 07:54:09 -07:00
2026-05-09 08:06:47 -07:00
2026-10-04 07:58:41 -07:00
2026-08-28 11:43:13 -07:00
2026-08-17 07:50:37 -07:00
2026-05-07 20:14:59 -07:00
2026-10-01 11:57:48 -07:00
2026-10-03 07:54:09 -07:00
2026-10-01 11:57:48 -07:00
2026-10-03 07:54:09 -07:00
2026-10-01 11:57:48 -07:00
2026-09-26 18:57:53 -04:00
2026-08-29 09:06:54 -07:00
2026-08-29 09:06:54 -07:00
2026-10-11 15:56:22 +00:00
2026-10-08 15:43:32 +00:00
2026-10-08 17:40:06 +00:00
2026-08-14 22:02:07 -07:00
2026-08-14 22:02:07 -07:00
2026-08-14 22:02:07 -07:00
2026-05-14 21:55:29 -07:00
2026-08-29 09:06:54 -07:00
2026-05-07 20:14:59 -07:00
2026-05-27 16:09:38 -07:00
2026-08-15 09:37:04 -07:00
2026-03-28 08:35:24 -06:00
2026-06-18 10:45:05 -07:00
2026-09-26 18:57:53 -04:00
2026-09-26 18:57:53 -04:00
2026-08-15 11:42:19 -07:00
2026-08-29 09:06:54 -07:00
2026-04-25 22:52:15 -07:00
2026-10-16 22:00:32 +00:00
2026-10-16 22:00:32 +00:00
2026-05-27 16:09:38 -07:00
2026-08-21 15:32:26 -07:00
2026-05-09 08:06:47 -07:00
2026-09-21 12:27:25 -04:00
2026-09-21 12:27:25 -04:00
2026-08-31 08:55:30 -07:00
2026-09-29 08:58:49 -07:00
2026-09-26 18:57:53 -04:00
2026-10-04 07:58:41 -07:00
2026-08-14 22:02:07 -07:00
2026-10-03 07:54:09 -07:00
2026-09-23 08:54:53 -04:00
2026-08-29 09:06:54 -07:00
2026-08-14 22:02:07 -07:00
2026-08-16 19:34:41 -07:00
2026-10-16 13:29:38 -07:00
2026-08-15 09:37:04 -07:00
2026-08-14 22:02:07 -07:00
2026-10-16 22:00:32 +00:00
2026-09-23 08:54:53 -04:00
2026-10-04 07:58:41 -07:00
2026-09-22 14:57:52 -04:00
2026-10-01 11:57:48 -07:00
2026-06-09 21:02:30 -07:00
2026-09-14 14:32:45 -07:00
2026-10-04 07:58:41 -07:00
2026-03-26 11:15:24 -06:00
2026-10-08 10:36:00 +00:00
2026-04-04 10:17:05 -07:00
2026-10-03 07:54:09 -07:00
2026-08-16 19:34:41 -07:00
2026-10-04 07:58:41 -07:00