security: fix SSRF, file size DoS, PermissionError shadowing, and CI/CD supply chain gaps#19

Draft

Copilot wants to merge 3 commits intomainfrom

copilot/fix-ssrf-risk-in-sdks

Commits on Mar 1, 2026

Initial plan
Copilot
committed
security: fix SSRF, file size DoS, PermissionError shadowing, and CI/CD supply chain gaps

Copilot
and
numbers-official
committed
security: add explicit permissions to release test job (CodeQL fix)

Copilot
and
numbers-official
committed