🏗️ Phase 1 for production readyness

lib/markdown.ts

@@ -15,6 +15,15 @@ export function sanitizePath(inputPath: string): string {
   if (normalized.includes('..') || path.isAbsolute(normalized)) {
     throw new Error('Invalid path')
   }
+
+  // CRITICAL: Verify resolved path stays within content directory
+  const resolvedPath = path.resolve(POSTS_PATH, normalized)
+  const allowedBasePath = path.resolve(POSTS_PATH)
+
+  if (!resolvedPath.startsWith(allowedBasePath)) {
+    throw new Error('Path traversal attempt detected')
+  }
+
   return normalized
 }