fix(security): validate resolved data path to prevent path traversal

server/utils/password-reset-log.js

@@ -14,7 +14,15 @@ function getDataPath(filename) {
 
   const cwd = process.cwd()
   const dataDir = cwd.endsWith('.output') ? path.join(cwd, '../server/data') : path.join(cwd, 'server/data')
-  return path.join(dataDir, safeName)
+
+  // build candidate path and verify it's inside the expected data directory
+  const candidate = path.join(dataDir, safeName)
+  const resolved = path.resolve(candidate)
+  const resolvedDataDir = path.resolve(dataDir)
+  if (!resolved.startsWith(resolvedDataDir + path.sep) && resolved !== resolvedDataDir) {
+    throw new Error('Invalid data filename (outside data directory)')
+  }
+  return resolved
 }
 
 const LOG_FILE = getDataPath('password-reset.log.jsonl')