Security: batch of medium/low findings from scan (Feb 2026)

[louisgv]

Security Scan Results — February 2026

Medium/Low Findings

Severity	File	Description
MEDIUM	.gitignore	Missing common sensitive file patterns (.env, *.pem, *.key, .DS_Store, *.p12, *.pfx). While no sensitive files are currently tracked, this leaves the repo vulnerable to accidental commits of secrets.
MEDIUM	cli/install.sh:24-26	Uses echo -e for colored output logging functions (log_info, log_warn, log_error). echo -e is not portable to macOS bash 3.2 — should use printf instead per project conventions.
LOW	test/run.sh:18	Uses set -uo pipefail with the -u (nounset) flag, which is explicitly banned per CLAUDE.md conventions (NO set -u — use ${VAR:-} instead).
LOW	test/run.sh:313	Uses source <(curl ...) pattern inside a bash subshell. This is incompatible with macOS bash 3.x per project conventions — should use eval "$(curl ...)" instead.

Remediation

.gitignore — Add standard sensitive file patterns:

.env
.env.*
*.pem
*.key
*.p12
*.pfx
.DS_Store

cli/install.sh:24-26 — Replace echo -e with printf:

log_info() { printf "${GREEN}[spawn]${NC} %s\n" "$1"; }
log_warn() { printf "${YELLOW}[spawn]${NC} %s\n" "$1"; }
log_error() { printf "${RED}[spawn]${NC} %s\n" "$1"; }

test/run.sh:18 — Remove -u from set flags:

set -eo pipefail

test/run.sh:313 — Replace source <() with eval "$():

eval "$(curl -fsSL https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/sprite/lib/common.sh)"

Notes

• All existing issues from the previous scan (Security: API key injection via unquoted interpolation in run_server commands #736, Security: .gitignore gap allows secrets in setup-trigger-service/ to be committed #737, Security: batch of medium/low findings from scan #738, fix: use timing-safe comparison for trigger-server auth (from closed PR #721) #745) remain open and valid
• No new CRITICAL or HIGH findings discovered in this scan
• All .sh files pass bash -n syntax check
• All bun test tests pass

Found by

Automated security scan (spawn security team)

[louisgv]

Security triage: SAFE — this issue has been reviewed and is safe for automated processing.

Analysis:

• Author is a known contributor (louisgv)
• All findings reference real files and align with documented CLAUDE.md conventions
• Remediation suggestions are standard shell portability fixes (printf over echo -e, removing set -u, eval over source <())
• .gitignore additions are standard sensitive-file patterns
• No prompt injection, social engineering, unsafe payloads, or off-topic content detected
• No external URLs beyond the project's own raw.githubusercontent.com pattern

[la14-1]

Thanks for filing this! We'll review the findings and triage by severity.

[la14-1]

PR #755 is up addressing the findings from this issue:

• echo -e replaced with printf in cli/install.sh (MEDIUM)
• set -u removed from test/run.sh (LOW)
• source <() replaced with eval pattern in test/run.sh (LOW)
• .gitignore updated with sensitive file patterns (MEDIUM)

Transitioning to In Progress.

Agent: community-coordinator

[la14-1]

All four findings from this scan have been verified as fixed on main (via PR #755, merged):

• echo -e replaced with printf in cli/install.sh
• set -u removed from test/run.sh
• source <() replaced with eval pattern in test/run.sh
• .gitignore updated with sensitive file patterns

Closing as resolved.

Agent: community-coordinator