The http.Server in the web UI (commands/webui.go) was vulnerable to
Slowloris attacks (G112, CWE-400) due to missing timeout configurations.
This allowed clients to hold connections open indefinitely.

The fix adds ReadHeaderTimeout, WriteTimeout, and IdleTimeout to the
http.Server configuration to prevent this resource exhaustion.

The detectGitPath function was vulnerable to path traversal (G304, CWE-22).
A specially crafted .git file with a 'gitdir:' entry could lead to
reading arbitrary files on the filesystem if it contained an absolute path
or a '..' sequence.

The fix prevents absolute paths in 'gitdir:' entries and ensures that
relative paths are correctly resolved relative to the .git file's location,
mitigating the path traversal vulnerability.

The makeIndex function in repository/index_bleve.go used os.ModePerm (0777)
when creating directories (G301, CWE-276). This is overly permissive and
could lead to unintended write access.

The fix changes the permissions to 0755, restricting write access to the owner
while allowing read and execute for others, improving security.

…show command

The cmd.RegisterFlagCompletionFunc call in newUserShowCommand (commands/user/user_show.go)
ignored a potential error return (G104, CWE-703). This could hide issues
with flag completion registration.

The fix adds an explicit error check and panics if the registration fails,
ensuring that such issues are immediately visible during development.

…command

The cmd.RegisterFlagCompletionFunc call in NewUserCommand (commands/user/user.go)
ignored a potential error return (G104, CWE-703). This could hide issues
with flag completion registration.

The fix adds an explicit error check and panics if the registration fails,
ensuring that such issues are immediately visible during development.

The backend.Close() call inside t.Cleanup in newTestEnv (commands/execenv/env_testing.go)
ignored a potential error return (G104, CWE-703). In a test, this can hide
issues with the test itself or the code being tested during teardown.

The fix adds an explicit error check within the t.Cleanup function and calls
t.Errorf to report any cleanup failures, ensuring test integrity.

…ommand

Multiple cmd.RegisterFlagCompletionFunc calls in NewBugCommand (commands/bug/bug.go)
ignored potential error returns (G104, CWE-703). This could hide issues
with flag completion registration.

The fix adds explicit error checks and panics if any registration fails,
ensuring that such issues are immediately visible during development. This
applies to the 'status', 'author', 'participant', 'actor', 'label', 'no',
'by', 'direction', and 'format' flags.

…e new command

The cmd.RegisterFlagCompletionFunc call in newBridgeNewCommand (commands/bridge/bridge_new.go)
ignored a potential error return (G104, CWE-703). This could hide issues
with flag completion registration.

The fix adds an explicit error check and panics if the registration fails,
ensuring that such issues are immediately visible during development.

The LaunchEditor function was vulnerable to path traversal (G304, CWE-22).
The 'fileName' parameter could be manipulated to access files outside
the intended local storage root.

The fix adds a check to ensure that the resolved path remains within
the local storage root, preventing unauthorized file access.