design-explorer

No clear malware or supply-chain sabotage is present. The code implements a legitimate local design-review server and contains path and input validation in several sensitive areas. The primary security concern is unauthenticated access: especially with --tailnet, remote peers can read project content and invoke state-changing file operations. It should be restricted to trusted users/networks and ideally protected with authentication and stronger authorization.