Deployment log files were stored under a directory named after the
container's hostname, which Docker changes whenever the container is
recreated, so every older log download returned 404. Logs now live under
logs/<appname>/. The download handler still finds logs written by older
versions under any hostname directory.
Model: opus-5-5
The deploy-log download handler passed a request-derived path to
http.ServeFile, which gosec flags as G703 (path traversal via taint).
The handler now opens the log through an os.Root confined to the deploy
log directory, so any escaping path is rejected at runtime (404) and the
file is streamed with http.ServeContent. A regression test plants a
sentinel outside the log dir and asserts the traversal is refused and its
contents never served; removing the guard makes that test fail. No
//nolint used.
Model: opus-4-8
sneak
clawbot