[MaxHalford]

Summary

• Narrow Google OAuth scopes and reject unexpected grants; discover projects through the BigQuery API.
• Cap bytes billed per query and fetch subsequent pages from the original BigQuery job.
• Escape dynamic SQL identifiers and filter values in pivot and DuckDB result paths.
• Clear both IndexedDB and Squill's OPFS database on Reset all data.
• Self-host pinned Pyodide and SQLGlot assets, tighten CSP, update privacy disclosures, and add a dependency audit gate.

Verification

• make check passed (229 tests, type check, lint, production build).
• npm audit --audit-level=moderate reported zero vulnerabilities.
• Production preview initialized DuckDB and SQLGlot from bundled assets.

Administrator follow-up

BigQuery read-only OAuth scope can still authorize Cloud Storage reads where user IAM allows them. Restrict sensitive GCS access and intended BigQuery projects through IAM before approving this client for company data. Corridor's findings API does not yet recognize the Squill repository; plan analysis was used during implementation.