fix(growth): security hardening — bun -e interpolation, pkill race, input validation

[AhmedTMM]

Summary

Batch security hardening for growth.sh and reddit-fetch.ts, resolving 9 real findings from the security scanner. Separately, I'll leave comments on 5 stale/hallucinated issues recommending they be closed, and 1 out-of-scope one (valibot refactor) for a follow-up PR.

growth.sh

• Unsafe bun -e string interpolation → env-var passing, per .claude/rules/shell-scripts.md. All four sites fixed (POST_COUNT, prompt template injection, stream-json extractor, candidate extractor). Closes security: [HIGH] Command injection via unsafe variable interpolation in growth.sh #3188, security: Command injection via unquoted temp file path in growth.sh bun -e #3221, security: Command injection via unquoted variable in growth.sh line 67 #3223.
• pkill race / empty-var defense → setsid claude ... so claude owns its own process group, then kill -SIG -PGID instead of racing pkill -P. Adds a numeric regex guard on CLAUDE_PID. Closes security: [MEDIUM] Race condition in pkill usage in growth.sh #3193, security: [HIGH] Unsafe pkill with potentially empty PID variable in growth.sh #3205.
• SPA_TRIGGER_SECRET visible in ps/cmdline → Authorization header written to a 0600 curl -K config file; body written to a 0600 temp file instead of here-string. Closes security: Potential secret leak via unquoted SPA_TRIGGER_SECRET in process list #3224.
• Housekeeping — drop dead REDDIT_JSON=$(cat ...) line; extend the cleanup trap to also remove CLAUDE_OUTPUT_FILE, SPA_AUTH_FILE, SPA_BODY_FILE.

reddit-fetch.ts

• Basic-auth / header injection via CLIENT_ID/CLIENT_SECRET → validate no : or CRLF on startup. Closes security: [HIGH] Missing input validation on Reddit credentials #3198.
• CRLF injection into User-Agent via REDDIT_USERNAME → validate against /^[A-Za-z0-9_-]{1,64}$/ on startup. Closes security: Header injection via unvalidated Reddit username in reddit-fetch.ts #3207.
• Path traversal in /user/${author}/comments via a hostile Reddit post author → same regex validation + encodeURIComponent as defense in depth. Closes security: [HIGH] Path traversal in Reddit username URL construction in reddit-fetch.ts #3202.

Closes

#3188, #3193, #3198, #3202, #3205, #3207, #3221, #3223, #3224

Not touched by this PR

• security: Manual typeguards used instead of valibot validation in SPA code #3200 (manual typeguards instead of valibot) — real but out of scope; it's a cross-cutting refactor touching setup-spa/helpers.ts, setup-spa/main.ts, and reddit-fetch.ts. Should be its own PR.
• security: [HIGH] Command injection via unquoted X_DATA_FILE in growth.sh #3287, security: [HIGH] Shell expansion in growth.sh safe_substitute() function #3180, security: [MEDIUM] Credential exposure via temp file in growth.sh #3182, security: [MEDIUM] Potential credential exposure in growth.sh error logging #3226, security: [HIGH] Command injection via heredoc in growth.sh curl POST #3191 — these appear to be scanner hallucinations or stale (e.g. X_DATA_FILE doesn't exist, safe_substitute() was already refactored away, etc.). I'll leave a comment on each recommending closure.

Test plan

• bash -n growth.sh — syntax clean
• bunx biome check src/ — 0 errors on 184 files
• bun test — 2043/2043 pass
• Manual: next growth cycle runs cleanly on the VM (reviewer to verify after merge)

[louisgv]

Security Review

Verdict: APPROVED
Commit: 80aca08

Findings

No security issues found. All changes are security hardening improvements:

growth.sh:

• ✅ bun -e interpolation fixed (lines 68, 148-163, 180) — data passed via env vars per shell-scripts.md
• ✅ Process group killing (lines 110, 124, 126) — atomic setsid + kill -PGID replaces race-prone pkill -P
• ✅ CLAUDE_PID validation (lines 118-120) — guards against empty/non-numeric PID
• ✅ SPA secret protection (lines 203-214) — passed via curl -K config file, never on command line
• ✅ Temp file cleanup (line 37) — auth/body files added to cleanup trap

reddit-fetch.ts:

• ✅ Credential validation (lines 26-28) — rejects : and newlines, prevents Basic-auth corruption and header injection
• ✅ Username validation (lines 33-37) — CRLF injection prevention in User-Agent header
• ✅ Author field sanitization (lines 222-223) — prevents path traversal, encodeURIComponent as defense-in-depth

Tests

• bash -n: PASS
• bun test: PASS (2104 pass, 0 fail)
• curl|bash: N/A (no install script changes)
• macOS compat: OK (uses env vars, no bash 4+ features)

---

-- security/pr-reviewer