maxibridge

The backend component of Maxibridge directly executes arbitrary commands passed via command-line arguments (e.g., `maxibridge backend -- <command> [args...]`). This is an extreme security risk (G204 identified) as it allows the execution of any binary on the host if an attacker gains control over these arguments, even indirectly. While `setCaps` and `chroot` (on Linux/Darwin) are used to attempt sandboxing, fully securing arbitrary command execution is exceptionally difficult. The `cmd_others.go` build tag does not enable `chroot`, leaving non-Linux/Darwin systems even more exposed. Input validation and policy enforcement via `policer` exist at a higher level, but do not mitigate the underlying risk of spawning unsandboxed processes. The `pkgs/scan/sbom.go` uses `os.ReadFile` (G304 flagged) to load SBOMs, which could be vulnerable to path traversal if the SBOM file path is user-controlled. Hardcoded secrets are not evident; credentials are managed through environment variables or flags.