BaaRai e6f4de5ddc fix(security): scrub startup secrets before any child can spawn ...

The scrub ran in main after server.New returned, but New resumes every
non-terminal task before returning, and those loops start workers that run
shells. Move the scrub into New, right after both environment readers, and
start MCP discovery after it as well: both paths spawn child processes.

New takes an option rather than scrubbing unconditionally. The test suite
builds several servers in one process and still needs ARTEX_PG_DSN on later
calls, so only the binary opts in.

2026-11-03 22:14:35 +01:00

..

artex

fix(security): scrub startup secrets before any child can spawn

2026-11-03 22:14:35 +01:00