security: uplift GitHub code-scanning + secret-scanning backlog (deferred to 0.6.3)

[thedancingdeveloper]

Triage of the repo Security tab as of 2026-09-09 (main @ 0.6.2). Remediation deferred to 0.6.3; this issue captures the backlog so nothing is lost.

Dependabot

• 0 open. ✅

Secret scanning (1)

• Google API Key (google_api_key, validity active) — alert M0 Foundation: storage spine, audit/events, operation registry, CI #1, flagged in mobile/android/app/google-services.json:18 (and the engine/mobile/... mirror). This is a Firebase Android client key: embedded in every APK by design and not a server secret (per Google). The file is already gitignored / not in the current tree (only google-services.json.example is tracked).
• Action: dismiss the alert with justification (Firebase client key, not a secret); confirm the key has Google-Cloud application restrictions (package name + signing SHA-1) — an operator step. Consider whether the key persists in git history post-reset; if so, it is low-value to rewrite for a non-secret key.

Code scanning / CodeQL (66: 1 critical, 65 high)

• Critical — rust/request-forgery (SSRF) at engine/server/src/vogt_tools.rs:400: the request URL derives from a user-provided value. Needs review: is the destination host validated/allowlisted before the fetch? Highest priority.
• High — rust/path-injection cluster in engine/server/src/* (agent_tasks.rs, prompt_files.rs, push.rs, history.rs, scrollback.rs, files.rs, …): user-influenced paths reaching the filesystem. Each site needs review — some are likely validated-path false positives, others may be genuinely exploitable. Fix real ones (canonicalize + confine under a root), dismiss FPs with justification.
• High — rust/cleartext-transmission — mostly in engine/server/tests/integration.rs (test fixtures using http://). Likely dismissable as test-only.
• High — rust/uncontrolled-allocation-size — agent_tasks.rs:3231, scrollback.rs:75: bound allocations from untrusted sizes.
• High — py/incomplete-url-substring-sanitization — in tests/test_forge_*.py: test-only URL substring checks; dismissable.

Suggested approach for 0.6.3

1. Fix the critical SSRF and the genuinely exploitable source path-injections / allocation-size sites.
2. Dismiss the test-only / validated-path false positives with written justification (auditable, reversible).
3. Resolve the secret-scanning alert as above.
4. Optionally tune the CodeQL config (scope, query filters) to cut recurring test-file noise.

Full per-alert list is in the repo Security tab; counts above are the 2026-09-09 snapshot.