akitaonrails merged akitaonrails/FrankMD#120 · July 24, 2026 10:46 fix(security): contain paths by ancestry, not string prefix #120 ProblemThe three path guards — NotesService#safe_path, ImagesService.safe_path, and NotesController#serve_asset — each checked containment with fu… +117 -23 1 comment