[Terrib1e]

Summary

This PR resolves two build/ingest script security weaknesses identified during a defensive audit (Elijah Clark / @Terrib1e):

Note on SECURITY.md: SECURITY.md directs build-script security reports to ../../security/advisories/new, which currently returns 404 because Settings -> Code security -> Private vulnerability reporting is disabled on the repository. If you enable Private Vulnerability Reporting or publish a GitHub Security Advisory (GHSA-*) for this fix, please credit @Terrib1e (Elijah Clark).

1. Shell Command Interpolation (CWE-78) in scripts/build.js and scripts/strix-fetch.js

• Mechanics:
  • addedDateFollow(file) in scripts/build.js passed double-quoted string interpolation (execSync(\git log --follow --diff-filter=A --format=%ad --date=short -- "${file}"`)) to /bin/shduringpull_request CI (build.ymlruns withpermissions: contents: write`).
  • fetchDb() and dumpStreams() in scripts/strix-fetch.js interpolated DB_URL (STRIX_DB_URL / STRIX_SLUG / STRIX_DB) and dbPath into /bin/sh command strings via execSync.
• Remediation: Replaced execSync shell strings with execFileSync argument arrays (matching the pattern already used in scripts/package-release.js) and sanitized DB_NAME with path.basename().

2. Unbounded --brand Path Resolution (CWE-22) in scripts/archive-sources.js

• Mechanics: camerasFromArgs() resolved --brand <arg> (reachable via workflow_dispatch.inputs.scope in archive-sources.yml) using path.join("cameras", args[brandIdx + 1]) without verifying that the resolved directory remains inside cameras/.
• Remediation: Added path.resolve containment check ensuring the target directory is a strict child of cameras/.

[ch-bas]

Merged — thanks @Terrib1e for the careful report and the clean fix. Verified locally that the build output is unchanged and the --brand containment rejects traversal.