fix(security): prevent shell command injection in sandbox file ops (#313)

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -1,95 +1,56 @@
 name: Bug report
-description: Report a reproducible defect affecting Autograder behavior.
+description: Report a reproducible defect with minimal required information.
 title: "[Bug] "
 body:
   - type: markdown
     attributes:
       value: |
-        Thanks for reporting this issue.
-        Please include concrete reproduction details so maintainers can triage quickly.
+        Thanks for reporting this bug. Keep it short and focused.
 
   - type: textarea
     id: summary
     attributes:
       label: Summary
-      description: A short description of the bug.
-      placeholder: What is broken?
-    validations:
-      required: true
-
-  - type: textarea
-    id: environment
-    attributes:
-      label: Environment
-      description: Runtime details where the issue happens.
-      placeholder: |
-        - Environment: local / staging / production
-        - Branch or commit:
-        - Language/template involved:
-        - API/Web client version:
+      description: What is broken?
+      placeholder: One short paragraph describing the problem.
     validations:
       required: true
 
   - type: textarea
     id: steps
     attributes:
       label: Steps to reproduce
-      description: Numbered steps to trigger the issue.
+      description: Optional, but helpful for reliable reproduction.
       placeholder: |
         1. Go to ...
         2. Configure ...
         3. Run/submit ...
         4. Observe ...
-    validations:
-      required: true
 
   - type: textarea
     id: observed
     attributes:
       label: Observed behavior
       description: What actually happened?
-    validations:
-      required: true
 
   - type: textarea
     id: expected
     attributes:
       label: Expected behavior
       description: What should have happened?
-    validations:
-      required: true
-
-  - type: textarea
-    id: suspected_root_cause
-    attributes:
-      label: Suspected root cause (optional)
-      description: If you already have a hypothesis, add it here.
 
   - type: textarea
-    id: impact
+    id: environment
     attributes:
-      label: Impact
-      description: Why this matters (who is affected, severity, blocked flows).
-      placeholder: e.g. Teachers cannot publish assignments with `dont_fail` tests.
-    validations:
-      required: true
+      label: Environment (optional)
+      description: Version, branch, runtime, or deployment context if relevant.
+      placeholder: |
+        - Branch/commit:
+        - Runtime:
+        - Local/CI/Prod:
 
   - type: textarea
     id: references
     attributes:
       label: References (optional)
       description: Related issues/PRs/logs/screenshots.
-      placeholder: |
-        - Related: #123
-        - API issue: webtech-network/api-grader-prisma#456
-
-  - type: checkboxes
-    id: checks
-    attributes:
-      label: Checklist
-      options:
-        - label: I searched for existing issues before opening this one.
-          required: true
-        - label: I added enough details for someone else to reproduce this bug.
-          required: true
-

.github/ISSUE_TEMPLATE/feature-proposal.yml

@@ -1,101 +1,46 @@
 name: Feature proposal
-description: Propose a new feature with scope, rationale, and acceptance criteria.
+description: Propose a new feature with lightweight structure.
 title: "[Feature] "
 body:
   - type: markdown
     attributes:
       value: |
         Use this template for new features and product capabilities.
+        Keep details concise.
 
   - type: textarea
     id: summary
     attributes:
       label: Feature overview
-      description: What is the feature?
+      description: What should be added or changed?
       placeholder: Describe the feature in a few lines.
     validations:
       required: true
 
   - type: textarea
-    id: why
+    id: motivation
     attributes:
-      label: Why
-      description: Problem/opportunity and expected value.
-      placeholder: Why do we need this now?
-    validations:
-      required: true
-
-  - type: textarea
-    id: scope
-    attributes:
-      label: Scope (phase-based if applicable)
-      description: Define rollout phases, boundaries, and priorities.
-      placeholder: |
-        Phase 1:
-        - ...
-
-        Phase 2:
-        - ...
-    validations:
-      required: true
-
-  - type: textarea
-    id: functional_requirements
-    attributes:
-      label: Functional requirements summary
-      description: Core behaviors and constraints.
-      placeholder: List required capabilities and expected behavior.
-    validations:
-      required: true
-
-  - type: textarea
-    id: architecture
-    attributes:
-      label: Architecture notes
-      description: Expected implementation direction, data model, or integration notes.
+      label: Motivation (optional)
+      description: Why is this feature needed?
 
   - type: textarea
-    id: deliverables
+    id: proposal
     attributes:
-      label: Deliverables
-      description: Concrete outputs expected across backend/frontend/docs/tests.
-      placeholder: |
-        - Backend:
-        - Frontend:
-        - Documentation:
-        - Tests:
-    validations:
-      required: true
+      label: Proposed solution (optional)
+      description: Suggested implementation direction.
 
   - type: textarea
     id: acceptance_criteria
     attributes:
-      label: Acceptance criteria
+      label: Acceptance criteria (optional)
       description: Use checklist format whenever possible.
       placeholder: |
         - [ ] Criterion 1
         - [ ] Criterion 2
         - [ ] Criterion 3
-    validations:
-      required: true
 
   - type: textarea
     id: references
     attributes:
-      label: References
+      label: References (optional)
       description: Related issues/PRs/docs/specs.
-      placeholder: |
-        - Parent issue:
-        - Depends on:
-        - Spec doc:
-
-  - type: checkboxes
-    id: checks
-    attributes:
-      label: Checklist
-      options:
-        - label: I checked for related existing feature requests.
-          required: true
-        - label: I included scope boundaries and acceptance criteria.
-          required: true
-

.github/ISSUE_TEMPLATE/hypothesis-rfc.yml

@@ -1,20 +1,12 @@
 name: Hypothesis / RFC
-description: Capture exploratory proposals and open design questions.
+description: Capture exploratory proposals with minimal process overhead.
 title: "[Hypothesis] "
 body:
   - type: markdown
     attributes:
       value: |
         Use this template for early-stage ideas that still require validation.
 
-  - type: textarea
-    id: context
-    attributes:
-      label: Context
-      description: What current scenario motivated this hypothesis?
-    validations:
-      required: true
-
   - type: textarea
     id: hypothesis
     attributes:
@@ -24,60 +16,28 @@ body:
       required: true
 
   - type: textarea
-    id: constraints
+    id: value
     attributes:
-      label: Constraints and assumptions
-      description: Known constraints, decisions, or guardrails.
-      placeholder: |
-        Defined constraints:
-        - ...
-
-        Assumptions:
-        - ...
+      label: Expected value (optional)
+      description: What outcome do we expect if this works?
 
   - type: textarea
     id: open_questions
     attributes:
-      label: Open questions
+      label: Open questions (optional)
       description: List unresolved decisions that need team input.
       placeholder: |
         - Should we...?
         - What is the impact of...?
-    validations:
-      required: true
 
   - type: textarea
     id: validation
     attributes:
-      label: Validation plan
+      label: Validation plan (optional)
       description: How this hypothesis will be evaluated (tests, spikes, metrics).
-    validations:
-      required: true
-
-  - type: textarea
-    id: success_criteria
-    attributes:
-      label: Success criteria
-      description: Evidence that would validate or invalidate the hypothesis.
-      placeholder: |
-        - [ ] Signal 1
-        - [ ] Signal 2
-    validations:
-      required: true
 
   - type: textarea
     id: references
     attributes:
       label: References (optional)
       description: Related discussions/issues/PRs/docs.
-
-  - type: checkboxes
-    id: checks
-    attributes:
-      label: Checklist
-      options:
-        - label: I clearly separated confirmed constraints from open questions.
-          required: true
-        - label: I included a validation plan and measurable success criteria.
-          required: true
-