- mcp_server.py: use shlex.quote() on all shell-interpolated values to
prevent command injection via ticket title/description/human_id
- corvid/router.py: add alphanumeric-only regex validation for environment
prefix; add full ancestor cycle detection before setting parent_id;
import re
- Add SECURITY_REVIEW.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
