Hermes
cdf9e8d3ef
DC-082: Convert all 6 execSync() calls with template-string interpolation to execFileSync() with argv arrays — no shell parsing of user-controlled input. Files: routes/ca.js (5 calls), src/docker/self-updater.js (1 call). Also removed stale execSync imports (Codex LOW finding). DC-064: Add --memory=512m --memory-swap=1g --cpus=1.5 to docker run in start.sh to prevent container OOM from taking down the host. Codex grade: A (30,783 tokens). All 1539 tests pass.