fix(sandbox): keep Windows restricted-token SIDs narrow (no Users broaden) - #640

Open

euxaristia wants to merge 3 commits into

Gitlawb:mainfrom

euxaristia:fix/windows-sandbox-restricted-token-sids

Commits on Aug 22, 2026

fix(sandbox): keep Windows restricted-token SIDs narrow and fail closed on DenyRead
euxaristia
committed
c41f55b
fix(sandbox): address CodeRabbit review feedback on PR 640
euxaristia
committed
86840f6

Commits on Aug 24, 2026

refactor(sandbox): Address CodeRabbit nitpicks on PR 640.

euxaristia
and
cairn-code
committed
64665f6