15 lines
933 B
JSON
15 lines
933 B
JSON
{
|
|
"feature_id": "F-059",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "No new attack surface. Backend resize is still parameterised and runs server-side; adding max-height does not introduce new input. Frontend change is CSS-only on existing image elements. No new env vars, no new headers, no new routes.",
|
|
"evidence": [
|
|
"sharp resize uses parameterised width and a derived maxHeight (no SQL, no user input)",
|
|
"Frontend change touches CSS className strings only — no new props, no new endpoints, no new auth checks",
|
|
"Path traversal mitigation in the dynamic /uploads/[...path] handler is unchanged (SAFE_SEGMENT regex still enforced)",
|
|
"No secrets, no env vars, no new dependencies",
|
|
"All four resize sites updated identically (no drift between admin/frontend/storefront)",
|
|
"git diff scope limited to upload routes and frontend CSS classes"
|
|
],
|
|
"timestamp": "2026-08-19T14:10:00Z"
|
|
} |