# Plan: security-hardening

**Branch:** feature/security-hardening

## Phases

- [x] Validators and config reader hardening
  - Spec: spec-1.md
- [x] runGit utility and full execSync elimination
  - Spec: spec-2.md
  - Depends on: Phase 1
