[thinhnx128]

Defensive Security Summary

This PR resolves three defensive security vulnerabilities identified during our static security audit of arakoodev/EdgeChains:

1. SQL Injection Prevention in PostgresClient.dbQuery() (CWE-89)

• Issue: JS/edgechains/arakoodev/src/db/src/lib/postgres-client/PostgresClient.ts interpolated this.arkRequest.query, this.namespace, this.tableName, this.arkRequest.metadataTable, and numeric RRF weights directly into raw SQL strings.
• Fix: Added escapeSqlLiteral() (doubling single quotes and stripping null bytes), validateSqlIdentifier() (^[A-Za-z_][A-Za-z0-9_]{0,62}$), and sanitizeNumber() while preserving the exact single-string entityManager.query(query) call signature for backward compatibility.
• Tests: Added Jest unit tests in postgresClient.test.ts verifying quote escaping and invalid identifier rejection.

2. Shell Command Injection & Double-Unlink Hardening in sync-rpc.ts (CWE-78)

• Issue: JS/edgechains/arakoodev/src/sync-rpc/lib/sync-rpc.ts invoked execSync(\node ${scriptPath}`)via a shell (which breaks on temporary directories containing spaces or special characters) and calledfs.unlinkSync(scriptPath)twice whenJSON.parse` failed.
• Fix: Replaced execSync with execFileSync(process.execPath, [scriptPath]) (no shell interpolation) and moved temporary script cleanup into a finally block guarded by fs.existsSync(scriptPath).

3. Loopback-Only Binding in JS/wasm/sync-rpc/worker.js (CWE-668)

• Issue: server.listen(process.argv[2]) bound the unauthenticated sync-rpc TCP worker (which dynamically require()s modules) to all network interfaces (0.0.0.0 / ::).
• Fix: Explicitly bound the worker socket to loopback (127.0.0.1) matching the client host.

[thinhnx128]

I have read the Arakoo CLA Document and I hereby sign the CLA

[thinhnx128]

Closing this to reduce review load — it wasn't requested by the maintainers. Thanks for your time; happy to reopen if it's useful.