[ralyodio]

Follow-up to #246. Cron's PATH has no Node, so diskpush (which needs Node 24, provided by mise) refused and the backup prune never ran. The script now puts the mise shims on its own PATH. rm's per-file errors on root-owned files left by Docker builds are replaced by one 'partly deleted' log line. Checked with a bare env -i PATH=/usr/bin:/bin: diskpush runs.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity	Rule	Location
HIGH	py-ssrf-outbound-request	dev2/dev2-site:151
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1099
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1903
HIGH	sh-remote-script-execution	root-ubuntu.sh:3262
HIGH	sh-remote-script-execution	root-ubuntu.sh:3263
HIGH	sh-remote-script-execution	root-ubuntu.sh:5168
HIGH	sh-remote-script-execution	root-ubuntu.sh:5172
HIGH	sh-remote-script-execution	root-w3bs-os.sh:3639
HIGH	sh-remote-script-execution	root-w3bs-os.sh:3640
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5569
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5579
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5586
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5602
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5607
HIGH	sh-plaintext-download	root-w3bs-os.sh:6289
MEDIUM	sql-template-interpolation	dev2/dev2-site:1334
MEDIUM	sql-template-interpolation	dev2/dev2-site:1411
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:5376
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/emoji.ts:167
MEDIUM	redos-nested-quantifier	src/icon.ts:166
MEDIUM	redos-nested-quantifier	src/mail.ts:1060
MEDIUM	sql-template-interpolation	src/users-dump.ts:487
MEDIUM	sql-string-concatenation	src/users-dump.ts:507
MEDIUM	sql-template-interpolation	src/users-dump.ts:540
MEDIUM	sql-string-concatenation	src/users-dump.ts:574
MEDIUM	redos-nested-quantifier	src/wcag.ts:556
LOW	secret-generic-credential	src/credentials.ts:41
LOW	secret-generic-credential	src/credentials.ts:58
LOW	secret-generic-credential	src/credentials.ts:61
LOW	secret-generic-credential	src/credentials.ts:66
LOW	secret-generic-credential	src/user-export.ts:689
LOW	secret-generic-credential	src/user-export.ts:695
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/mail.test.ts:141
LOW	secret-generic-credential	test/proxy.test.ts:69
LOW	secret-generic-credential	test/proxy.test.ts:85
LOW	secret-generic-credential	test/shorten.test.ts:36
LOW	secret-database-url	test/users-dump.test.ts:108
LOW	secret-database-url	test/users-dump.test.ts:119
LOW	secret-database-url	test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.