- server.js: sanitize static file paths to prevent directory traversal (GET /../../sgclaw_config.json would expose API key) - config-loader.js: fix normalizeBaseUrl to strip /v1 before appending, preventing double /v1 for non-standard base URLs 🤖 Generated with [Qoder][https://qoder.com]