修复漏洞积压

Use $codex-security:fix-finding to fix this security finding and verify the issue no longer reproduces.

Source: [Codex Security report / Linear or Jira ticket / GitHub Security Advisory / HackerOne or Bugcrowd report / other authorized source]
Title and affected component: [finding title and component]
Vulnerable source, sink, or broken control: [known path or unknown]
Attacker-controlled input and impact: [input, prerequisites, and impact]
Expected security invariant: [behavior the fix must enforce]
Existing proof: [report path, PoC, reproducer, test, or validation notes]
Affected files and lines: [paths and lines, or unknown]
Constraints: [supported behavior to preserve, test command, rollout requirement, or none]

Requirements:
- Confirm that the issue still exists before changing code when feasible.
- Make the smallest change that enforces the intended security invariant.
- Add focused regression coverage or the strongest repeatable validation artifact available.
- Verify legitimate behavior still works and the original issue no longer reproduces.
- Keep unrelated backlog findings and refactors out of this change.

Report the changed files, tests or validation artifacts, exact commands and results, proof that the original issue no longer reproduces, and remaining uncertainty. If the issue is already fixed, show the evidence and do not change code.