Resolve repository security findings

[jongan69]

Summary\n\n- fix XML entity decoding and eBay image-host validation\n- migrate installs and CI from npm to Bun\n- pin actions, minimize permissions, and enforce an exact expiring audit exception\n- align Expo SDK 57 patch dependencies\n\n## Verification\n\n- bun install --frozen-lockfile\n- lint and app/worker typecheck\n- 34 safety checks and 52 documentation-link checks\n- Expo Doctor 21/21\n- worker security tests and Wrangler dry-run\n- Android export\n\nCloses #9\nTracks #8

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 812c13d2-533c-46b6-8714-9c08127f91e2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jongan69]

Manual review completed: XML decoding is single-pass, eBay URLs require HTTPS plus the exact ebayimg.com registrable host, and the audit exception is exact, linked, and expiring. CI now uses Bun, read-only permissions, immutable action SHAs, and non-persistent checkout credentials. Frozen install, lint, app/worker typecheck, 34 safety checks, 52 doc checks, Expo Doctor 21/21, worker tests, Wrangler dry-run, Android export, hosted CI, CodeQL, and GitGuardian all passed.