- server.js: sanitize static file paths to prevent directory traversal
(GET /../../sgclaw_config.json would expose API key)
- config-loader.js: fix normalizeBaseUrl to strip /v1 before appending,
preventing double /v1 for non-standard base URLs
🤖 Generated with [Qoder][https://qoder.com]