fix(security): harden process execution — shell injection + credential leak via ps aux - #387

Closed

dumko2001 wants to merge 3 commits into

NVIDIA:mainfrom

dumko2001:security/harden-process-execution

Commits on Mar 19, 2026

fix(runner): safe argv execution primitives; fix opts.env overwrite
dumko2001
committed
8fc752a
fix(cli): replace shell-string commands with argv arrays
dumko2001
committed
0b988ed
fix(credentials): use env-lookup form for --credential; secrets never in argv
dumko2001
committed
892bc25