🔒 [security] Explicit shell=False to prevent command injection theater

scripts/ci/sandboxed_web_e2e.py

@@ -104,6 +104,7 @@ def start_service(label: str, command: str, cwd: Path, env: dict[str, str], logs
     log_file = log_path.open("w", encoding="utf-8")
     process = subprocess.Popen(
         shlex.split(command),
+        shell=False,  # nosec B603
         cwd=cwd,
         env=env,
         text=True,
@@ -139,6 +140,7 @@ def run_shell(command: str, cwd: Path, env: dict[str, str], timeout: int) -> sub
     """Run a shell command and capture its output."""
     return subprocess.run(
         shlex.split(command),
+        shell=False,  # nosec B603
         cwd=cwd,
         env=env,
         text=True,

tests/test_sandboxed_web_e2e.py

@@ -181,13 +181,13 @@ def fake_run(*args, **kwargs):
     assert service.command == "npm run dev"
     assert service.log_path == tmp_path / "backend.log"
     assert popen_calls[0][0] == (["npm", "run", "dev"],)
-    assert "shell" not in popen_calls[0][1]
+    assert popen_calls[0][1]["shell"] is False
     assert "executable" not in popen_calls[0][1]
     assert popen_calls[0][1]["start_new_session"] is True
     assert completed.returncode == 7
     assert run_calls[0][0] == (["npm", "test"],)
     assert run_calls[0][1]["timeout"] == 5
-    assert "shell" not in run_calls[0][1]
+    assert run_calls[0][1]["shell"] is False
     assert "executable" not in run_calls[0][1]