Opus finding
seed-outgoing-pr.ts trusts unvalidated CLI args (owner/repo/branch) without sanity-checking format
lowapi-contracthigh
- apps/web/scripts/seed-outgoing-pr.ts:30-50
Only `upstream-pr-number` is validated. A typo like passing an empty string, a URL, or a leading-slash path for owner/repo would silently insert garbage that the cron sweep would then submit to GitHub's `pulls.get`, returning 404s repeatedly until manual cleanup. There is no rollback. Admin tool, low blast radius, but a one-line regex would harden it.
Recommendation
Add regex validation for owner/repo against GitHub's allowed characters ([A-Za-z0-9-_.]+) and non-empty branch, exiting 2 on mismatch.