[APS-19076][APS-19077][APS-19078] fix: security hardening — env-var allowlist, workflow SHA pinning, report HTML sanitization#85

Open

Jimesh-browserstack wants to merge 3 commits intomasterfrom

fix/aps-19076-19077-19078-security-bundle

Commits on May 7, 2026

fix(security): bundle for APS-19076 / APS-19077 / APS-19078

Jimesh-browserstack
and
claude
committed
[APS-19078] restrict data: scheme to <img> in report sanitizer
Jimesh-browserstack
committed
[APS-19078] fix CI: replace regex HTML strip with sanitize-html (CodeQL)
Jimesh-browserstack
committed