Severity: low (bundle). Three persistence-layer robustness gaps:
settings::load_from applies no bounds, so a hand-edited scrollback_lines = 5000000 passes straight to vt100::Parser::new and can exhaust memory (the UI caps at 100000). Clamp on load.save_to always writes a fixed <path>.tmp in all three config modules; two concurrent nerdterm instances can clobber each other's temp file. Use a unique per-process temp name, and fsync file+dir around the rename to deliver the crash-safety the comment claims.quarantine() uses a whole-second suffix; two corruptions in the same second overwrite each other's backup. Add a collision-proof suffix.
Locations: src/config/settings.rs:60,100, src/config/address_book.rs:104, src/config/known_hosts.rs:136.
Filed from the 2026-07-09 full-repo review (findings adversarially verified before filing).
Severity: low (bundle). Three persistence-layer robustness gaps:
settings::load_fromapplies no bounds, so a hand-editedscrollback_lines = 5000000passes straight tovt100::Parser::newand can exhaust memory (the UI caps at 100000). Clamp on load.save_toalways writes a fixed<path>.tmpin all three config modules; two concurrent nerdterm instances can clobber each other's temp file. Use a unique per-process temp name, andfsyncfile+dir around the rename to deliver the crash-safety the comment claims.quarantine()uses a whole-second suffix; two corruptions in the same second overwrite each other's backup. Add a collision-proof suffix.Locations:
src/config/settings.rs:60,100,src/config/address_book.rs:104,src/config/known_hosts.rs:136.Filed from the 2026-07-09 full-repo review (findings adversarially verified before filing).