fix(security): projectId path guard, npm HIGH CVEs, Foote novelty sign

[seonghobae]

Summary

Commercial-readiness loop cycle: land the highest-priority unique security and product correctness fixes that were stuck as a storm of near-duplicate open PRs.

• Python projectId path-traversal guard — reject /, \, and exact . / .. before any path join (defense-in-depth with Rust).
• npm HIGH CVEs — pin brace-expansion@5.0.9 and postcss@8.5.25 via root overrides (clears GHSA-3jxr-9vmj-r5cp and GHSA-r28c-9q8g-f849).
• Foote novelty kernel sign — on-diagonal quadrants +1, cross -1, so section boundaries produce positive peaks that detect_boundaries can detect (Python reference + Rust native).

Supersedes open clusters:

• Path-traversal: 🛡️ Sentinel: [CRITICAL] 프로젝트 ID 경로 탐색(Path Traversal) 취약점 수정 #726, 🛡️ Sentinel: [HIGH] projectId 경로 탐색(Path Traversal) 취약점 수정 #719, 🛡️ Sentinel: [HIGH] projectId 경로 탐색(Path Traversal) 취약점 수정 #703, 🛡️ Sentinel: [CRITICAL/HIGH] projectId 경로 조작(Path Traversal) 취약점 수정 #696, 🛡️ Sentinel: [HIGH] Fix Path Traversal in projectId #664
• npm/security CVE remediations: fix(security): bump brace-expansion + postcss to clear two high CVEs #725, fix(security): clear postcss and brace-expansion high-severity advisories #720, fix(security): remediate base-branch supply-chain CVEs (setuptools, brace-expansion, postcss) #718, fix(security): remediate base-branch Security Scan findings (Python + npm) #714, fix(security): remediate base-branch supply-chain findings blocking all open PRs #713 (and overlapping lockfile churn on path-traversal PRs)
• Novelty kernel: fix(sections): correct inverted Foote checkerboard novelty kernel sign #721 (and perf-only checkerboard PRs that keep the inverted sign)

Security Notes

Topic	Detail
Attack surface	Untrusted projectId on analysis job payloads; transitive npm build-tool CVEs
Trust boundary	Tauri IPC (Rust) already validates; Python engine now fails closed at the API boundary
Mitigations	Shape allowlist (no separators / exact . / ..); npm overrides to fixed releases
Safe failure	ValueError with path-traversal message; no generic exec
Logging / privacy	Warning log only; no bulk dump of untrusted paths
Test points	test_api traversal cases + my..id allow; Foote peak-at-boundary; existing parity suite

Test plan

• uv run --project services/analysis-engine pytest targeted: test_api validation cases, test_segmenter Foote peak, novelty parity
• npm audit → 0 vulnerabilities after overrides
• CI full quickcheck on PR

Verification

Local: targeted pytest 5 passed; ruff clean on touched files.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 19 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c992bce8-3c60-43e2-b08a-1a6156b26099

📥 Commits

Reviewing files that changed from the base of the PR and between f8343f5 and 04462f1.

⛔ Files ignored due to path filters (2)

• package-lock.json is excluded by !**/package-lock.json
• services/analysis-engine/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• .trivyignore
• package.json
• services/analysis-engine/pyproject.toml
• services/analysis-engine/rust/src/lib.rs
• services/analysis-engine/src/bandscope_analysis/api.py
• services/analysis-engine/src/bandscope_analysis/sections/segmenter.py
• services/analysis-engine/tests/test_api.py
• services/analysis-engine/tests/test_segmenter.py

---

_{Comment @coderabbitai help to get the list of available commands.}