fix: escape template interpolations and move release to trusted publishing (review bundle 8) #21

• L-OPS-1 Messaging HTML templates do not escape appName, token or URL, and the validators are loose. Not exploitable through the API's direct-send path; an admin who sets app_name can inject markup. Side effect: allow-listed custom-scheme magic link redirects never send. Where: packages/core/src/service.ts, validation.ts:10-14,25-35. Fix: HTML-escape interpolations, emit new URL(x).href, require exactly http: or https: where a web URL is meant, and decide how custom-scheme redirects are sent.
• L-OPS-2 .github/workflows/release.yml:55-56 publishes with a long-lived NPM_TOKEN. Move to trusted publishing with provenance and delete the secret. Same change in seamless-auth-types and seamless-auth-oidc-provider.

Source

Internal security review of 2026-11-09 (bundle 8, L-OPS-1 and L-OPS-2), read at 5534f0e. Found by reading code; nothing was executed. Status: Reported.