[GingerGraham]

Summary

Adds the per-version security audit of logging.sh at the 3.0.0 tag, requested in #157:
docs/security-reviews/2026-11-06-claude-security-audit-v3.0.0.md.

This PR contains the report only. Following #157, the fixes are left to separate sessions.

Results

• All 10 findings from the PR feat(logging)!: support POSIX sh (dash, busybox ash) #147 pre-release review are fixed. Each was re-tested against 3.0.0.
• 6 Low and 4 informational findings. None can be exploited by an unprivileged attacker on a default system, so none needed a private advisory.
• 4 of the 6 Low findings behave the same in 2.7.0. The other 2 are in code that 3.0 added for BusyBox and POSIX shells.

ID	Severity	Issue	Title
SEC-01	Low	#160	BusyBox logger exception accepts a chain of links through a writable dir
SEC-02	Low	#161	Shell detection spoofable with an inherited version variable + PATH file
SEC-03	Low	#162	Config tag over 64 characters is truncated but not sanitized
SEC-04	Low	#163	set_timezone_utc / set_journal_logging write unvalidated values
SEC-05	Low	#164	Config format control characters used despite "may be stripped" warning
SEC-06	Low	#165	SCRIPT_NAME from the environment unsanitized before init_logger
INF-03	Info	#166	Release job installs npm packages by major version with a write token
INF-04	Info	#167	Docs and the security-review skill out of date (includes INF-01)

INF-02 is included in #160.

Testing

• Repros were run in bash 5.2, bash --posix, dash, zsh 5.9 and busybox ash 1.36.1, with GNU and busybox userlands, in the C and C.UTF-8 locales.
• Full suite, run as a non-root user: 687 tests, 680 passed, 0 failed, 7 skipped (missing locales).
• MarkdownLint (markdownlint-cli v0.47.0, the repository config) passes on the new report.
• Not tested: BusyBox 1.37 with musl (Alpine) was not available.

Refs #157

---

Generated by Claude Code

[Copilot]

Note

Copilot was unable to complete this review at the selected tier due to model policy or plan restrictions.

🟢 Approval recommended

The change only adds a versioned security audit report documenting existing findings for logging.sh with remediation explicitly deferred, and the sole noted issue is a minor documentation citation nit rather than an unresolved functional or verification gap.

No open issues 🎉

What changed in this PR

This pull request adds a versioned security audit report documenting the logging.sh review results at tag v3.0.0, as requested in #157, with remediation intentionally deferred to follow-up work.

Changes:

• Add a new per-version security review document for logging.sh (v3.0.0) including scope/methodology, findings (6 Low / 4 Info), repro notes, and retest status for prior items.

Review note (nit):

• The report cites CLAUDE.md as the source of a “public setters validate input” requirement, but CLAUDE.md is not present in the repo; update the citation to the actual checklist/source doc.

File	Summary
docs/​security-reviews/​2026-11-06-claude-security-audit-v3.0.0.md	New v3.0.0 security audit report for logging.sh, documenting findings, evidence/repros, and test coverage notes.

_{Review effort: Balanced}