Pull requests

• fix: safe parse of MAX_SANDBOX_DURATION and enforce maxDuration bounds

  #3·feafel opened Oct 12, 2026·

  ·

• security: enforce upper bound on maxDuration to prevent cost abuse

  #2·Alicepoltora opened Oct 10, 2026·

  ·

• fix: block protocol-relative URLs in isRelativeUrl (open redirect after OAuth)

  #1·Alicepoltora opened Oct 4, 2026·

  ·