Fix session and remote-input flood protection

[mrprecioustech]

Summary

• coalesce and rate-limit remote input, bound renderer/main-process queues, and suppress rejection log storms
• add bounded API rate limits for joins, token minting, signaling, chat, and stats
• reject oversized control packets and send stale SFU pointer/scroll samples unreliably to avoid backlog

Validation

• targeted web and desktop unit suites
• web and desktop typechecks
• git diff --check

[github-actions]

ThreatCrush Security Scan

66 finding(s)

HIGH/CRITICAL: 13 | MEDIUM: 35 | LOW: 18

Severity	Rule	Location
HIGH	sh-eval-expansion	.githooks/pre-commit:33
HIGH	js-electron-node-integration	apps/desktop/src/main/window.ts:49
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:691
HIGH	sh-unquoted-expansion-destructive	apps/installer/scripts/install.sh:715
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:813
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:815
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:894
HIGH	sh-unquoted-expansion-destructive	apps/installer/scripts/install.sh:910
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:1064
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:1066
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:1128
HIGH	sh-remote-script-execution	apps/livekit/setup-livekit-server.sh:93
HIGH	sh-remote-script-execution	apps/turn/deploy-droplet.sh:62
MEDIUM	insecure-temp-file	.githooks/commit-msg:19
MEDIUM	insecure-temp-file	.githooks/post-commit:22
MEDIUM	insecure-temp-file	apps/installer/scripts/install.sh:370
MEDIUM	insecure-temp-file	apps/installer/scripts/install.sh:393
MEDIUM	insecure-temp-file	apps/installer/scripts/install.sh:402
MEDIUM	insecure-temp-file	apps/installer/scripts/install.sh:438
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:48
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:73
MEDIUM	js-unescaped-html-sink	apps/web/src/app/c/[handle]/page.tsx:192
MEDIUM	js-unescaped-html-sink	apps/web/src/app/l/[joinCode]/page.tsx:125
MEDIUM	js-unescaped-html-sink	apps/web/src/app/l/[joinCode]/page.tsx:219
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:142
MEDIUM	js-unescaped-html-sink	apps/web/src/app/live/page.tsx:145
MEDIUM	js-unescaped-html-sink	apps/web/src/app/page.tsx:122
MEDIUM	js-unescaped-html-sink	apps/web/src/app/pricing/page.tsx:284
MEDIUM	js-open-redirect	apps/web/src/app/pricing/UpgradeButton.tsx:50
MEDIUM	js-unescaped-html-sink	apps/web/src/app/u/[username]/page.tsx:282
MEDIUM	redos-nested-quantifier	apps/web/src/lib/deliverable.ts:11
MEDIUM	manifest-install-lifecycle-script	package.json:55
MEDIUM	sql-template-interpolation	packages/ai-core/src/prompts.ts:36
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/apt.ts:154
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/apt.ts:160
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/apt.ts:208
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/apt.ts:313
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/aur.ts:341
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/chocolatey.ts:264
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/chocolatey.ts:288
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/rpm.ts:201
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/rpm.ts:261
MEDIUM	js-shell-exec-interpolation	scripts/release.mjs:145
MEDIUM	js-shell-exec-interpolation	scripts/release.mjs:146
MEDIUM	js-shell-exec-interpolation	scripts/release.mjs:147
MEDIUM	js-shell-exec-interpolation	scripts/version-bump.mjs:169
MEDIUM	js-shell-exec-interpolation	scripts/version-bump.mjs:170
MEDIUM	js-shell-exec-interpolation	scripts/version-bump.mjs:171
LOW	insecure-temp-file	apps/desktop/src/main/streaming/index.test.ts:64
LOW	secret-generic-credential	apps/livekit/fly.toml:12

…and 16 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.