Security Hardening Update

We completed a comprehensive security audit and fixed 20+ vulnerabilities.

Critical Fixes {#critical-fixes}

• SQL injection: Database handler name/password validation
• Shell injection: WordPress manager uses Go pipes instead of sh -c
• Path traversal: Trash delete, upload filename, restore path
• Symlink escape: File manager, FTP, WordPress path validation
• Privilege escalation: External commands (unrar, ffprobe) now run as user
• Unauthenticated endpoints: Setup and SSE endpoints guarded

New Security Features {#new-security-features}

• ensureUserDir() helper: symlink-safe directory creation
• ACME challenge pre-check before SSL issuance
• PECL extension auto-rebuild when system libraries update

[Screenshot: security-audit.png]