- Replace eval() with ast.literal_eval() in pdf_utils.py to fix
unauthenticated remote code execution via crafted PDF uploads
(reported by OX Security)
- Sanitize HTML output with DOMPurify to prevent XSS
- Restrict CORS origins (configurable via CORS_ORIGINS env var)
- Suppress raw exception details in API error responses
- Cap Image.MAX_IMAGE_PIXELS to prevent decompression bomb DoS
- Add security regression test suite
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
3dac0741b1