security The CodeQL Alert: Shell Command Built From Environment Values Alert #178 flagged a cleanup script that built a shell string from process.env.DB_PASSWORD. The fix isn't escaping the value — it's not building a shell string at all.
security What a Year of CodeQL Alerts Looks Like on a Solo Project Eight code-scanning alerts, four distinct classes, fixed one at a time across a year of commits — the real pattern is that rate limiting had to be fixed six separate times before it stuck.
