Path Traversal: Asset paths written to disk via fs.writeFileSync/createWriteStream were vulnerable to directory traversal; fix added canonicalization and prefix check, but sibling loaders may lack it.

Path Traversal: Studio write endpoints lacked symlink checks and extension allowlist, enabling arbitrary file writes; hardening added multiple guards that may not be replicated in all routes.

Path Traversal: Site name validation was insufficient to prevent path traversal when deploying to S3; anchored regex and dot-segment rejection were added, but the cloudrun twin was fixed separately.