fix(security): the three code scanning alerts 3.5.0 raised

src/main/routes/clips.ts

@@ -329,8 +329,11 @@ clipsRouter.post('/batch/compress-published', asyncHandler(async (req, res) => {
         await new CompressPublishedClipAction().execute({ clipId });
       } catch (error) {
         failed += 1;
+        // The id is from the request, so it is an argument, never part of the
+        // format string, where a `%s` would be read as a directive.
         console.error(
-          `[batch] compressing the published copy of clip ${clipId} failed:`,
+          '[batch] compressing the published copy of clip %s failed: %s',
+          String(clipId),
           error instanceof Error ? error.message : String(error),
         );
       }

src/main/services/streamdeck/server.ts

@@ -90,7 +90,10 @@ export async function startStreamDeck(): Promise<void> {
       };
 
       const path = (req.url ?? '').split('?')[0];
-      const route = ROUTES[`${req.method} ${path}`];
+      // An own property only: the key comes from the request, and a bare lookup
+      // would also find what every object inherits.
+      const key = `${req.method} ${path}`;
+      const route = Object.hasOwn(ROUTES, key) ? ROUTES[key] : undefined;
       if (!route) return send(404, { error: 'No such key' });
 
       void readBody(req)