From the pre-publication audit of the first bundle: - Server hrefs are split before decoding, a segment at a time, and an entry with a '.', '..' or empty name, or one holding a separator, is not listed: '/root/../x' or '%2e%2e' would have put a download outside the folder. - Local paths must resolve inside the folder, and nothing is written, moved, created or trashed through a symbolic link inside it. - Passwords go to https only (plain http to loopback addresses alone). - Chrome runs without its sandbox only when DAVSYNC_NO_SANDBOX=1 asks for it; the smoke test does, in CI VMs that run as root. Also: a folder's server root and its path on the server are kept apart (the sync URL is derived), the setup window can list and create folders on the server and locally, and changing where a folder points forgets its last-seen state so the next sync merges instead of mirroring deletions. CI installs libxml2 so the xml package's xmllint oracle tests run.