Linus OlofssonandClaude Opus 5.5
dc2bda8c07
Security review: GIT_URL (user:token@) was stored as the clone's remote URL, and the repo, .git included, was mounted into the container that runs npm install. Now: umask 077 + 700 directories, the remote is the clean URL, git gets the token from a credential helper at fetch/push time, and the container sees an empty tmpfs over .git. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>