Merge branch 'main' into fix/issue-27

Replace the hardcoded validTableNames allowlist with a regexp that
only allows [a-z0-9_] characters. This prevents SQL injection without
requiring maintenance of a separate allowlist when new tables are added.

Addresses review feedback from @sneak on PR #32.

internal/vaultik/blob_fetch_stub.go

@@ -1,28 +0,0 @@
-package vaultik
-
-// TODO: These are stub implementations for methods referenced but not yet
-// implemented. They allow the package to compile for testing.
-// Remove once the real implementations land.
-
-import (
-	"context"
-	"fmt"
-	"io"
-
-	"filippo.io/age"
-)
-
-// FetchAndDecryptBlobResult holds the result of fetching and decrypting a blob.
-type FetchAndDecryptBlobResult struct {
-	Data []byte
-}
-
-// FetchAndDecryptBlob downloads a blob, decrypts it, and returns the plaintext data.
-func (v *Vaultik) FetchAndDecryptBlob(ctx context.Context, blobHash string, expectedSize int64, identity age.Identity) (*FetchAndDecryptBlobResult, error) {
-	return nil, fmt.Errorf("FetchAndDecryptBlob not yet implemented")
-}
-
-// FetchBlob downloads a blob and returns a reader for the encrypted data.
-func (v *Vaultik) FetchBlob(ctx context.Context, blobHash string, expectedSize int64) (io.ReadCloser, int64, error) {
-	return nil, 0, fmt.Errorf("FetchBlob not yet implemented")
-}

internal/vaultik/blobcache.go

@@ -1,208 +0,0 @@
-package vaultik
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
-)
-
-
-// blobDiskCacheEntry tracks a cached blob on disk.
-type blobDiskCacheEntry struct {
-	key  string
-	size int64
-	prev *blobDiskCacheEntry
-	next *blobDiskCacheEntry
-}
-
-// blobDiskCache is an LRU cache that stores blobs on disk instead of in memory.
-// Blobs are written to a temp directory keyed by their hash. When total size
-// exceeds maxBytes, the least-recently-used entries are evicted (deleted from disk).
-type blobDiskCache struct {
-	mu       sync.Mutex
-	dir      string
-	maxBytes int64
-	curBytes int64
-	items    map[string]*blobDiskCacheEntry
-	head     *blobDiskCacheEntry // most recent
-	tail     *blobDiskCacheEntry // least recent
-}
-
-// newBlobDiskCache creates a new disk-based blob cache with the given max size.
-func newBlobDiskCache(maxBytes int64) (*blobDiskCache, error) {
-	dir, err := os.MkdirTemp("", "vaultik-blobcache-*")
-	if err != nil {
-		return nil, fmt.Errorf("creating blob cache dir: %w", err)
-	}
-	return &blobDiskCache{
-		dir:      dir,
-		maxBytes: maxBytes,
-		items:    make(map[string]*blobDiskCacheEntry),
-	}, nil
-}
-
-func (c *blobDiskCache) path(key string) string {
-	return filepath.Join(c.dir, key)
-}
-
-func (c *blobDiskCache) unlink(e *blobDiskCacheEntry) {
-	if e.prev != nil {
-		e.prev.next = e.next
-	} else {
-		c.head = e.next
-	}
-	if e.next != nil {
-		e.next.prev = e.prev
-	} else {
-		c.tail = e.prev
-	}
-	e.prev = nil
-	e.next = nil
-}
-
-func (c *blobDiskCache) pushFront(e *blobDiskCacheEntry) {
-	e.prev = nil
-	e.next = c.head
-	if c.head != nil {
-		c.head.prev = e
-	}
-	c.head = e
-	if c.tail == nil {
-		c.tail = e
-	}
-}
-
-func (c *blobDiskCache) evictLRU() {
-	if c.tail == nil {
-		return
-	}
-	victim := c.tail
-	c.unlink(victim)
-	delete(c.items, victim.key)
-	c.curBytes -= victim.size
-	_ = os.Remove(c.path(victim.key))
-}
-
-// Put writes blob data to disk cache. Entries larger than maxBytes are silently skipped.
-func (c *blobDiskCache) Put(key string, data []byte) error {
-	entrySize := int64(len(data))
-
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if entrySize > c.maxBytes {
-		return nil
-	}
-
-	// Remove old entry if updating
-	if e, ok := c.items[key]; ok {
-		c.unlink(e)
-		c.curBytes -= e.size
-		_ = os.Remove(c.path(key))
-		delete(c.items, key)
-	}
-
-	if err := os.WriteFile(c.path(key), data, 0600); err != nil {
-		return fmt.Errorf("writing blob to cache: %w", err)
-	}
-
-	e := &blobDiskCacheEntry{key: key, size: entrySize}
-	c.pushFront(e)
-	c.items[key] = e
-	c.curBytes += entrySize
-
-	for c.curBytes > c.maxBytes && c.tail != nil {
-		c.evictLRU()
-	}
-
-	return nil
-}
-
-// Get reads a cached blob from disk. Returns data and true on hit.
-func (c *blobDiskCache) Get(key string) ([]byte, bool) {
-	c.mu.Lock()
-	e, ok := c.items[key]
-	if !ok {
-		c.mu.Unlock()
-		return nil, false
-	}
-	c.unlink(e)
-	c.pushFront(e)
-	c.mu.Unlock()
-
-	data, err := os.ReadFile(c.path(key))
-	if err != nil {
-		c.mu.Lock()
-		if e2, ok2 := c.items[key]; ok2 && e2 == e {
-			c.unlink(e)
-			delete(c.items, key)
-			c.curBytes -= e.size
-		}
-		c.mu.Unlock()
-		return nil, false
-	}
-	return data, true
-}
-
-// ReadAt reads a slice of a cached blob without loading the entire blob into memory.
-func (c *blobDiskCache) ReadAt(key string, offset, length int64) ([]byte, error) {
-	c.mu.Lock()
-	e, ok := c.items[key]
-	if !ok {
-		c.mu.Unlock()
-		return nil, fmt.Errorf("key %q not in cache", key)
-	}
-	if offset+length > e.size {
-		c.mu.Unlock()
-		return nil, fmt.Errorf("read beyond blob size: offset=%d length=%d size=%d", offset, length, e.size)
-	}
-	c.unlink(e)
-	c.pushFront(e)
-	c.mu.Unlock()
-
-	f, err := os.Open(c.path(key))
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	buf := make([]byte, length)
-	if _, err := f.ReadAt(buf, offset); err != nil {
-		return nil, err
-	}
-	return buf, nil
-}
-
-// Has returns whether a key exists in the cache.
-func (c *blobDiskCache) Has(key string) bool {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	_, ok := c.items[key]
-	return ok
-}
-
-// Size returns current total cached bytes.
-func (c *blobDiskCache) Size() int64 {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.curBytes
-}
-
-// Len returns number of cached entries.
-func (c *blobDiskCache) Len() int {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return len(c.items)
-}
-
-// Close removes the cache directory and all cached blobs.
-func (c *blobDiskCache) Close() error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.items = nil
-	c.head = nil
-	c.tail = nil
-	c.curBytes = 0
-	return os.RemoveAll(c.dir)
-}

internal/vaultik/blobcache_test.go

@@ -1,189 +0,0 @@
-package vaultik
-
-import (
-	"bytes"
-	"crypto/rand"
-	"fmt"
-	"testing"
-)
-
-func TestBlobDiskCache_BasicGetPut(t *testing.T) {
-	cache, err := newBlobDiskCache(1 << 20)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer cache.Close()
-
-	data := []byte("hello world")
-	if err := cache.Put("key1", data); err != nil {
-		t.Fatal(err)
-	}
-
-	got, ok := cache.Get("key1")
-	if !ok {
-		t.Fatal("expected cache hit")
-	}
-	if !bytes.Equal(got, data) {
-		t.Fatalf("got %q, want %q", got, data)
-	}
-
-	_, ok = cache.Get("nonexistent")
-	if ok {
-		t.Fatal("expected cache miss")
-	}
-}
-
-func TestBlobDiskCache_EvictionUnderPressure(t *testing.T) {
-	maxBytes := int64(1000)
-	cache, err := newBlobDiskCache(maxBytes)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer cache.Close()
-
-	for i := 0; i < 5; i++ {
-		data := make([]byte, 300)
-		if err := cache.Put(fmt.Sprintf("key%d", i), data); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	if cache.Size() > maxBytes {
-		t.Fatalf("cache size %d exceeds max %d", cache.Size(), maxBytes)
-	}
-
-	if !cache.Has("key4") {
-		t.Fatal("expected key4 to be cached")
-	}
-	if cache.Has("key0") {
-		t.Fatal("expected key0 to be evicted")
-	}
-}
-
-func TestBlobDiskCache_OversizedEntryRejected(t *testing.T) {
-	cache, err := newBlobDiskCache(100)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer cache.Close()
-
-	data := make([]byte, 200)
-	if err := cache.Put("big", data); err != nil {
-		t.Fatal(err)
-	}
-
-	if cache.Has("big") {
-		t.Fatal("oversized entry should not be cached")
-	}
-}
-
-func TestBlobDiskCache_UpdateInPlace(t *testing.T) {
-	cache, err := newBlobDiskCache(1 << 20)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer cache.Close()
-
-	if err := cache.Put("key1", []byte("v1")); err != nil {
-		t.Fatal(err)
-	}
-	if err := cache.Put("key1", []byte("version2")); err != nil {
-		t.Fatal(err)
-	}
-
-	got, ok := cache.Get("key1")
-	if !ok {
-		t.Fatal("expected hit")
-	}
-	if string(got) != "version2" {
-		t.Fatalf("got %q, want %q", got, "version2")
-	}
-	if cache.Len() != 1 {
-		t.Fatalf("expected 1 entry, got %d", cache.Len())
-	}
-	if cache.Size() != int64(len("version2")) {
-		t.Fatalf("expected size %d, got %d", len("version2"), cache.Size())
-	}
-}
-
-func TestBlobDiskCache_ReadAt(t *testing.T) {
-	cache, err := newBlobDiskCache(1 << 20)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer cache.Close()
-
-	data := make([]byte, 1024)
-	if _, err := rand.Read(data); err != nil {
-		t.Fatal(err)
-	}
-	if err := cache.Put("blob1", data); err != nil {
-		t.Fatal(err)
-	}
-
-	chunk, err := cache.ReadAt("blob1", 100, 200)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !bytes.Equal(chunk, data[100:300]) {
-		t.Fatal("ReadAt returned wrong data")
-	}
-
-	_, err = cache.ReadAt("blob1", 900, 200)
-	if err == nil {
-		t.Fatal("expected error for out-of-bounds read")
-	}
-
-	_, err = cache.ReadAt("missing", 0, 10)
-	if err == nil {
-		t.Fatal("expected error for missing key")
-	}
-}
-
-func TestBlobDiskCache_Close(t *testing.T) {
-	cache, err := newBlobDiskCache(1 << 20)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if err := cache.Put("key1", []byte("data")); err != nil {
-		t.Fatal(err)
-	}
-	if err := cache.Close(); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestBlobDiskCache_LRUOrder(t *testing.T) {
-	cache, err := newBlobDiskCache(200)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer cache.Close()
-
-	d := make([]byte, 100)
-	if err := cache.Put("a", d); err != nil {
-		t.Fatal(err)
-	}
-	if err := cache.Put("b", d); err != nil {
-		t.Fatal(err)
-	}
-
-	// Access "a" to make it most recently used
-	cache.Get("a")
-
-	// Adding "c" should evict "b" (LRU), not "a"
-	if err := cache.Put("c", d); err != nil {
-		t.Fatal(err)
-	}
-
-	if !cache.Has("a") {
-		t.Fatal("expected 'a' to survive")
-	}
-	if !cache.Has("c") {
-		t.Fatal("expected 'c' to be present")
-	}
-	if cache.Has("b") {
-		t.Fatal("expected 'b' to be evicted")
-	}
-}

internal/vaultik/restore.go

@@ -109,11 +109,7 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 
 	// Step 5: Restore files
 	result := &RestoreResult{}
-	blobCache, err := newBlobDiskCache(4 * v.Config.BlobSizeLimit.Int64())
+	blobCache := make(map[string][]byte) // Cache downloaded and decrypted blobs
-	if err != nil {
-		return fmt.Errorf("creating blob cache: %w", err)
-	}
-	defer blobCache.Close()
 
 	for i, file := range files {
 		if v.ctx.Err() != nil {
@@ -145,7 +141,7 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		"duration", result.Duration,
 	)
 
-	v.printfStdout("Restored %d files (%s) in %s\n",
+	_, _ = fmt.Fprintf(v.Stdout, "Restored %d files (%s) in %s\n",
 		result.FilesRestored,
 		humanize.Bytes(uint64(result.BytesRestored)),
 		result.Duration.Round(time.Second),
@@ -158,14 +154,14 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		}
 
 		if result.FilesFailed > 0 {
-			v.printfStdout("\nVerification FAILED: %d files did not match expected checksums\n", result.FilesFailed)
+			_, _ = fmt.Fprintf(v.Stdout, "\nVerification FAILED: %d files did not match expected checksums\n", result.FilesFailed)
 			for _, path := range result.FailedFiles {
-				v.printfStdout("  - %s\n", path)
+				_, _ = fmt.Fprintf(v.Stdout, "  - %s\n", path)
 			}
 			return fmt.Errorf("%d files failed verification", result.FilesFailed)
 		}
 
-		v.printfStdout("Verified %d files (%s)\n",
+		_, _ = fmt.Fprintf(v.Stdout, "Verified %d files (%s)\n",
 			result.FilesVerified,
 			humanize.Bytes(uint64(result.BytesVerified)),
 		)
@@ -303,7 +299,7 @@ func (v *Vaultik) restoreFile(
 	targetDir string,
 	identity age.Identity,
 	chunkToBlobMap map[string]*database.BlobChunk,
-	blobCache *blobDiskCache,
+	blobCache map[string][]byte,
 	result *RestoreResult,
 ) error {
 	// Calculate target path - use full original path under target directory
@@ -387,7 +383,7 @@ func (v *Vaultik) restoreRegularFile(
 	targetPath string,
 	identity age.Identity,
 	chunkToBlobMap map[string]*database.BlobChunk,
-	blobCache *blobDiskCache,
+	blobCache map[string][]byte,
 	result *RestoreResult,
 ) error {
 	// Get file chunks in order
@@ -421,13 +417,13 @@ func (v *Vaultik) restoreRegularFile(
 
 		// Download and decrypt blob if not cached
 		blobHashStr := blob.Hash.String()
-		blobData, ok := blobCache.Get(blobHashStr)
+		blobData, ok := blobCache[blobHashStr]
 		if !ok {
 			blobData, err = v.downloadBlob(ctx, blobHashStr, blob.CompressedSize, identity)
 			if err != nil {
 				return fmt.Errorf("downloading blob %s: %w", blobHashStr[:16], err)
 			}
-			if putErr := blobCache.Put(blobHashStr, blobData); putErr != nil { log.Debug("Failed to cache blob on disk", "hash", blobHashStr[:16], "error", putErr) }
+			blobCache[blobHashStr] = blobData
 			result.BlobsDownloaded++
 			result.BytesDownloaded += blob.CompressedSize
 		}
@@ -515,7 +511,7 @@ func (v *Vaultik) verifyRestoredFiles(
 		"files", len(regularFiles),
 		"bytes", humanize.Bytes(uint64(totalBytes)),
 	)
-	v.printfStdout("\nVerifying %d files (%s)...\n",
+	_, _ = fmt.Fprintf(v.Stdout, "\nVerifying %d files (%s)...\n",
 		len(regularFiles),
 		humanize.Bytes(uint64(totalBytes)),
 	)
@@ -526,13 +522,13 @@ func (v *Vaultik) verifyRestoredFiles(
 		bar = progressbar.NewOptions64(
 			totalBytes,
 			progressbar.OptionSetDescription("Verifying"),
-			progressbar.OptionSetWriter(v.Stderr),
+			progressbar.OptionSetWriter(os.Stderr),
 			progressbar.OptionShowBytes(true),
 			progressbar.OptionShowCount(),
 			progressbar.OptionSetWidth(40),
 			progressbar.OptionThrottle(100*time.Millisecond),
 			progressbar.OptionOnCompletion(func() {
-				v.printfStderr("\n")
+				fmt.Fprint(os.Stderr, "\n")
 			}),
 			progressbar.OptionSetRenderBlankState(true),
 		)

internal/vaultik/snapshot.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"regexp"
 	"path/filepath"
 	"sort"
 	"strings"
@@ -86,7 +87,7 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 
 	// Print overall summary if multiple snapshots
 	if len(snapshotNames) > 1 {
-		_, _ = fmt.Fprintf(v.Stdout, "\nAll %d snapshots completed in %s\n", len(snapshotNames), time.Since(overallStartTime).Round(time.Second))
+		v.printfStdout("\nAll %d snapshots completed in %s\n", len(snapshotNames), time.Since(overallStartTime).Round(time.Second))
 	}
 
 	return nil
@@ -99,7 +100,7 @@ func (v *Vaultik) createNamedSnapshot(opts *SnapshotCreateOptions, hostname, sna
 	snapConfig := v.Config.Snapshots[snapName]
 
 	if total > 1 {
-		_, _ = fmt.Fprintf(v.Stdout, "\n=== Snapshot %d/%d: %s ===\n", idx, total, snapName)
+		v.printfStdout("\n=== Snapshot %d/%d: %s ===\n", idx, total, snapName)
 	}
 
 	// Resolve source directories to absolute paths
@@ -152,7 +153,7 @@ func (v *Vaultik) createNamedSnapshot(opts *SnapshotCreateOptions, hostname, sna
 		return fmt.Errorf("creating snapshot: %w", err)
 	}
 	log.Info("Beginning snapshot", "snapshot_id", snapshotID, "name", snapName)
-	_, _ = fmt.Fprintf(v.Stdout, "Beginning snapshot: %s\n", snapshotID)
+	v.printfStdout("Beginning snapshot: %s\n", snapshotID)
 
 	for i, dir := range resolvedDirs {
 		// Check if context is cancelled
@@ -164,7 +165,7 @@ func (v *Vaultik) createNamedSnapshot(opts *SnapshotCreateOptions, hostname, sna
 		}
 
 		log.Info("Scanning directory", "path", dir)
-		_, _ = fmt.Fprintf(v.Stdout, "Beginning directory scan (%d/%d): %s\n", i+1, len(resolvedDirs), dir)
+		v.printfStdout("Beginning directory scan (%d/%d): %s\n", i+1, len(resolvedDirs), dir)
 		result, err := scanner.Scan(v.ctx, dir, snapshotID)
 		if err != nil {
 			return fmt.Errorf("failed to scan %s: %w", dir, err)
@@ -275,35 +276,35 @@ func (v *Vaultik) createNamedSnapshot(opts *SnapshotCreateOptions, hostname, sna
 	}
 
 	// Print comprehensive summary
-	_, _ = fmt.Fprintf(v.Stdout, "=== Snapshot Complete ===\n")
+	v.printfStdout("=== Snapshot Complete ===\n")
-	_, _ = fmt.Fprintf(v.Stdout, "ID: %s\n", snapshotID)
+	v.printfStdout("ID: %s\n", snapshotID)
-	_, _ = fmt.Fprintf(v.Stdout, "Files: %s examined, %s to process, %s unchanged",
+	v.printfStdout("Files: %s examined, %s to process, %s unchanged",
 		formatNumber(totalFiles),
 		formatNumber(totalFilesChanged),
 		formatNumber(totalFilesSkipped))
 	if totalFilesDeleted > 0 {
-		_, _ = fmt.Fprintf(v.Stdout, ", %s deleted", formatNumber(totalFilesDeleted))
+		v.printfStdout(", %s deleted", formatNumber(totalFilesDeleted))
 	}
-	_, _ = fmt.Fprintln(v.Stdout)
+	v.printlnStdout()
-	_, _ = fmt.Fprintf(v.Stdout, "Data: %s total (%s to process)",
+	v.printfStdout("Data: %s total (%s to process)",
 		humanize.Bytes(uint64(totalBytesAll)),
 		humanize.Bytes(uint64(totalBytesChanged)))
 	if totalBytesDeleted > 0 {
-		_, _ = fmt.Fprintf(v.Stdout, ", %s deleted", humanize.Bytes(uint64(totalBytesDeleted)))
+		v.printfStdout(", %s deleted", humanize.Bytes(uint64(totalBytesDeleted)))
 	}
-	_, _ = fmt.Fprintln(v.Stdout)
+	v.printlnStdout()
 	if totalBlobsUploaded > 0 {
-		_, _ = fmt.Fprintf(v.Stdout, "Storage: %s compressed from %s (%.2fx)\n",
+		v.printfStdout("Storage: %s compressed from %s (%.2fx)\n",
 			humanize.Bytes(uint64(totalBlobSizeCompressed)),
 			humanize.Bytes(uint64(totalBlobSizeUncompressed)),
 			compressionRatio)
-		_, _ = fmt.Fprintf(v.Stdout, "Upload: %d blobs, %s in %s (%s)\n",
+		v.printfStdout("Upload: %d blobs, %s in %s (%s)\n",
 			totalBlobsUploaded,
 			humanize.Bytes(uint64(totalBytesUploaded)),
 			formatDuration(uploadDuration),
 			avgUploadSpeed)
 	}
-	_, _ = fmt.Fprintf(v.Stdout, "Duration: %s\n", formatDuration(snapshotDuration))
+	v.printfStdout("Duration: %s\n", formatDuration(snapshotDuration))
 
 	if opts.Prune {
 		log.Info("Pruning enabled - will delete old snapshots after snapshot")
@@ -422,13 +423,13 @@ func (v *Vaultik) ListSnapshots(jsonOutput bool) error {
 
 	if jsonOutput {
 		// JSON output
-		encoder := json.NewEncoder(os.Stdout)
+		encoder := json.NewEncoder(v.Stdout)
 		encoder.SetIndent("", "  ")
 		return encoder.Encode(snapshots)
 	}
 
 	// Table output
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
+	w := tabwriter.NewWriter(v.Stdout, 0, 0, 3, ' ', 0)
 
 	// Show configured snapshots from config file
 	if _, err := fmt.Fprintln(w, "CONFIGURED SNAPSHOTS:"); err != nil {
@@ -527,14 +528,14 @@ func (v *Vaultik) PurgeSnapshots(keepLatest bool, olderThan string, force bool)
 	}
 
 	if len(toDelete) == 0 {
-		fmt.Println("No snapshots to delete")
+		v.printlnStdout("No snapshots to delete")
 		return nil
 	}
 
 	// Show what will be deleted
-	fmt.Printf("The following snapshots will be deleted:\n\n")
+	v.printfStdout("The following snapshots will be deleted:\n\n")
 	for _, snap := range toDelete {
-		fmt.Printf("  %s (%s, %s)\n",
+		v.printfStdout("  %s (%s, %s)\n",
 			snap.ID,
 			snap.Timestamp.Format("2006-01-02 15:04:05"),
 			formatBytes(snap.CompressedSize))
@@ -542,19 +543,19 @@ func (v *Vaultik) PurgeSnapshots(keepLatest bool, olderThan string, force bool)
 
 	// Confirm unless --force is used
 	if !force {
-		fmt.Printf("\nDelete %d snapshot(s)? [y/N] ", len(toDelete))
+		v.printfStdout("\nDelete %d snapshot(s)? [y/N] ", len(toDelete))
 		var confirm string
 		if _, err := fmt.Scanln(&confirm); err != nil {
 			// Treat EOF or error as "no"
-			fmt.Println("Cancelled")
+			v.printlnStdout("Cancelled")
 			return nil
 		}
 		if strings.ToLower(confirm) != "y" {
-			fmt.Println("Cancelled")
+			v.printlnStdout("Cancelled")
 			return nil
 		}
 	} else {
-		fmt.Printf("\nDeleting %d snapshot(s) (--force specified)\n", len(toDelete))
+		v.printfStdout("\nDeleting %d snapshot(s) (--force specified)\n", len(toDelete))
 	}
 
 	// Delete snapshots (both local and remote)
@@ -569,10 +570,10 @@ func (v *Vaultik) PurgeSnapshots(keepLatest bool, olderThan string, force bool)
 		}
 	}
 
-	fmt.Printf("Deleted %d snapshot(s)\n", len(toDelete))
+	v.printfStdout("Deleted %d snapshot(s)\n", len(toDelete))
 
 	// Note: Run 'vaultik prune' separately to clean up unreferenced blobs
-	fmt.Println("\nNote: Run 'vaultik prune' to clean up unreferenced blobs.")
+	v.printlnStdout("\nNote: Run 'vaultik prune' to clean up unreferenced blobs.")
 
 	return nil
 }
@@ -613,11 +614,11 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio
 	}
 
 	if !opts.JSON {
-		fmt.Printf("Verifying snapshot %s\n", snapshotID)
+		v.printfStdout("Verifying snapshot %s\n", snapshotID)
 		if !snapshotTime.IsZero() {
-			fmt.Printf("Snapshot time: %s\n", snapshotTime.Format("2006-01-02 15:04:05 MST"))
+			v.printfStdout("Snapshot time: %s\n", snapshotTime.Format("2006-01-02 15:04:05 MST"))
 		}
-		fmt.Println()
+		v.printlnStdout()
 	}
 
 	// Download and parse manifest
@@ -635,18 +636,18 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio
 	result.TotalSize = manifest.TotalCompressedSize
 
 	if !opts.JSON {
-		fmt.Printf("Snapshot information:\n")
+		v.printfStdout("Snapshot information:\n")
-		fmt.Printf("  Blob count:   %d\n", manifest.BlobCount)
+		v.printfStdout("  Blob count:   %d\n", manifest.BlobCount)
-		fmt.Printf("  Total size:   %s\n", humanize.Bytes(uint64(manifest.TotalCompressedSize)))
+		v.printfStdout("  Total size:   %s\n", humanize.Bytes(uint64(manifest.TotalCompressedSize)))
 		if manifest.Timestamp != "" {
 			if t, err := time.Parse(time.RFC3339, manifest.Timestamp); err == nil {
-				fmt.Printf("  Created:      %s\n", t.Format("2006-01-02 15:04:05 MST"))
+				v.printfStdout("  Created:      %s\n", t.Format("2006-01-02 15:04:05 MST"))
 			}
 		}
-		fmt.Println()
+		v.printlnStdout()
 
 		// Check each blob exists
-		fmt.Printf("Checking blob existence...\n")
+		v.printfStdout("Checking blob existence...\n")
 	}
 
 	missing := 0
@@ -660,7 +661,7 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio
 		_, err := v.Storage.Stat(v.ctx, blobPath)
 		if err != nil {
 			if !opts.JSON {
-				fmt.Printf("  Missing: %s (%s)\n", blob.Hash, humanize.Bytes(uint64(blob.CompressedSize)))
+				v.printfStdout("  Missing: %s (%s)\n", blob.Hash, humanize.Bytes(uint64(blob.CompressedSize)))
 			}
 			missing++
 			missingSize += blob.CompressedSize
@@ -683,20 +684,20 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio
 		return v.outputVerifyJSON(result)
 	}
 
-	fmt.Printf("\nVerification complete:\n")
+	v.printfStdout("\nVerification complete:\n")
-	fmt.Printf("  Verified:     %d blobs (%s)\n", verified,
+	v.printfStdout("  Verified:     %d blobs (%s)\n", verified,
 		humanize.Bytes(uint64(manifest.TotalCompressedSize-missingSize)))
 	if missing > 0 {
-		fmt.Printf("  Missing:      %d blobs (%s)\n", missing, humanize.Bytes(uint64(missingSize)))
+		v.printfStdout("  Missing:      %d blobs (%s)\n", missing, humanize.Bytes(uint64(missingSize)))
 	} else {
-		fmt.Printf("  Missing:      0 blobs\n")
+		v.printfStdout("  Missing:      0 blobs\n")
 	}
-	fmt.Printf("  Status:       ")
+	v.printfStdout("  Status:       ")
 	if missing > 0 {
-		fmt.Printf("FAILED - %d blobs are missing\n", missing)
+		v.printfStdout("FAILED - %d blobs are missing\n", missing)
 		return fmt.Errorf("%d blobs are missing", missing)
 	} else {
-		fmt.Printf("OK - All blobs verified\n")
+		v.printfStdout("OK - All blobs verified\n")
 	}
 
 	return nil
@@ -704,7 +705,7 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio
 
 // outputVerifyJSON outputs the verification result as JSON
 func (v *Vaultik) outputVerifyJSON(result *VerifyResult) error {
-	encoder := json.NewEncoder(os.Stdout)
+	encoder := json.NewEncoder(v.Stdout)
 	encoder.SetIndent("", "  ")
 	if err := encoder.Encode(result); err != nil {
 		return fmt.Errorf("encoding JSON: %w", err)
@@ -830,11 +831,11 @@ func (v *Vaultik) RemoveSnapshot(snapshotID string, opts *RemoveOptions) (*Remov
 	if opts.DryRun {
 		result.DryRun = true
 		if !opts.JSON {
-			_, _ = fmt.Fprintf(v.Stdout, "Would remove snapshot: %s\n", snapshotID)
+			v.printfStdout("Would remove snapshot: %s\n", snapshotID)
 			if opts.Remote {
-				_, _ = fmt.Fprintln(v.Stdout, "Would also remove from remote storage")
+				v.printlnStdout("Would also remove from remote storage")
 			}
-			_, _ = fmt.Fprintln(v.Stdout, "[Dry run - no changes made]")
+			v.printlnStdout("[Dry run - no changes made]")
 		}
 		if opts.JSON {
 			return result, v.outputRemoveJSON(result)
@@ -845,17 +846,17 @@ func (v *Vaultik) RemoveSnapshot(snapshotID string, opts *RemoveOptions) (*Remov
 	// Confirm unless --force is used (skip in JSON mode - require --force)
 	if !opts.Force && !opts.JSON {
 		if opts.Remote {
-			_, _ = fmt.Fprintf(v.Stdout, "Remove snapshot '%s' from local database and remote storage? [y/N] ", snapshotID)
+			v.printfStdout("Remove snapshot '%s' from local database and remote storage? [y/N] ", snapshotID)
 		} else {
-			_, _ = fmt.Fprintf(v.Stdout, "Remove snapshot '%s' from local database? [y/N] ", snapshotID)
+			v.printfStdout("Remove snapshot '%s' from local database? [y/N] ", snapshotID)
 		}
 		var confirm string
-		if _, err := fmt.Fscanln(v.Stdin, &confirm); err != nil {
+		if err := v.scanlnStdin(&confirm); err != nil {
-			_, _ = fmt.Fprintln(v.Stdout, "Cancelled")
+			v.printlnStdout("Cancelled")
 			return result, nil
 		}
 		if strings.ToLower(confirm) != "y" {
-			_, _ = fmt.Fprintln(v.Stdout, "Cancelled")
+			v.printlnStdout("Cancelled")
 			return result, nil
 		}
 	}
@@ -882,10 +883,10 @@ func (v *Vaultik) RemoveSnapshot(snapshotID string, opts *RemoveOptions) (*Remov
 	}
 
 	// Print summary
-	_, _ = fmt.Fprintf(v.Stdout, "Removed snapshot '%s' from local database\n", snapshotID)
+	v.printfStdout("Removed snapshot '%s' from local database\n", snapshotID)
 	if opts.Remote {
-		_, _ = fmt.Fprintln(v.Stdout, "Removed snapshot metadata from remote storage")
+		v.printlnStdout("Removed snapshot metadata from remote storage")
-		_, _ = fmt.Fprintln(v.Stdout, "\nNote: Blobs were not removed. Run 'vaultik prune' to remove orphaned blobs.")
+		v.printlnStdout("\nNote: Blobs were not removed. Run 'vaultik prune' to remove orphaned blobs.")
 	}
 
 	return result, nil
@@ -929,7 +930,7 @@ func (v *Vaultik) RemoveAllSnapshots(opts *RemoveOptions) (*RemoveResult, error)
 
 	if len(snapshotIDs) == 0 {
 		if !opts.JSON {
-			_, _ = fmt.Fprintln(v.Stdout, "No snapshots found")
+			v.printlnStdout("No snapshots found")
 		}
 		return result, nil
 	}
@@ -938,14 +939,14 @@ func (v *Vaultik) RemoveAllSnapshots(opts *RemoveOptions) (*RemoveResult, error)
 		result.DryRun = true
 		result.SnapshotsRemoved = snapshotIDs
 		if !opts.JSON {
-			_, _ = fmt.Fprintf(v.Stdout, "Would remove %d snapshot(s):\n", len(snapshotIDs))
+			v.printfStdout("Would remove %d snapshot(s):\n", len(snapshotIDs))
 			for _, id := range snapshotIDs {
-				_, _ = fmt.Fprintf(v.Stdout, "  %s\n", id)
+				v.printfStdout("  %s\n", id)
 			}
 			if opts.Remote {
-				_, _ = fmt.Fprintln(v.Stdout, "Would also remove from remote storage")
+				v.printlnStdout("Would also remove from remote storage")
 			}
-			_, _ = fmt.Fprintln(v.Stdout, "[Dry run - no changes made]")
+			v.printlnStdout("[Dry run - no changes made]")
 		}
 		if opts.JSON {
 			return result, v.outputRemoveJSON(result)
@@ -986,10 +987,10 @@ func (v *Vaultik) RemoveAllSnapshots(opts *RemoveOptions) (*RemoveResult, error)
 		return result, v.outputRemoveJSON(result)
 	}
 
-	_, _ = fmt.Fprintf(v.Stdout, "Removed %d snapshot(s)\n", len(result.SnapshotsRemoved))
+	v.printfStdout("Removed %d snapshot(s)\n", len(result.SnapshotsRemoved))
 	if opts.Remote {
-		_, _ = fmt.Fprintln(v.Stdout, "Removed snapshot metadata from remote storage")
+		v.printlnStdout("Removed snapshot metadata from remote storage")
-		_, _ = fmt.Fprintln(v.Stdout, "\nNote: Blobs were not removed. Run 'vaultik prune' to remove orphaned blobs.")
+		v.printlnStdout("\nNote: Blobs were not removed. Run 'vaultik prune' to remove orphaned blobs.")
 	}
 
 	return result, nil
@@ -1043,7 +1044,7 @@ func (v *Vaultik) deleteSnapshotFromRemote(snapshotID string) error {
 
 // outputRemoveJSON outputs the removal result as JSON
 func (v *Vaultik) outputRemoveJSON(result *RemoveResult) error {
-	encoder := json.NewEncoder(os.Stdout)
+	encoder := json.NewEncoder(v.Stdout)
 	encoder.SetIndent("", "  ")
 	return encoder.Encode(result)
 }
@@ -1117,21 +1118,29 @@ func (v *Vaultik) PruneDatabase() (*PruneResult, error) {
 	)
 
 	// Print summary
-	_, _ = fmt.Fprintf(v.Stdout, "Local database prune complete:\n")
+	v.printfStdout("Local database prune complete:\n")
-	_, _ = fmt.Fprintf(v.Stdout, "  Incomplete snapshots removed: %d\n", result.SnapshotsDeleted)
+	v.printfStdout("  Incomplete snapshots removed: %d\n", result.SnapshotsDeleted)
-	_, _ = fmt.Fprintf(v.Stdout, "  Orphaned files removed: %d\n", result.FilesDeleted)
+	v.printfStdout("  Orphaned files removed: %d\n", result.FilesDeleted)
-	_, _ = fmt.Fprintf(v.Stdout, "  Orphaned chunks removed: %d\n", result.ChunksDeleted)
+	v.printfStdout("  Orphaned chunks removed: %d\n", result.ChunksDeleted)
-	_, _ = fmt.Fprintf(v.Stdout, "  Orphaned blobs removed: %d\n", result.BlobsDeleted)
+	v.printfStdout("  Orphaned blobs removed: %d\n", result.BlobsDeleted)
 
 	return result, nil
 }
 
-// getTableCount returns the count of rows in a table
+// validTableNameRe matches table names containing only lowercase alphanumeric characters and underscores.
+var validTableNameRe = regexp.MustCompile(`^[a-z0-9_]+$`)
+
+// getTableCount returns the count of rows in a table.
+// The tableName is sanitized to only allow [a-z0-9_] characters to prevent SQL injection.
 func (v *Vaultik) getTableCount(tableName string) (int64, error) {
 	if v.DB == nil {
 		return 0, nil
 	}
 
+	if !validTableNameRe.MatchString(tableName) {
+		return 0, fmt.Errorf("invalid table name: %q", tableName)
+	}
+
 	var count int64
 	query := fmt.Sprintf("SELECT COUNT(*) FROM %s", tableName)
 	err := v.DB.Conn().QueryRowContext(v.ctx, query).Scan(&count)