2 Commits

Include renames

Author	SHA1	Message	Date
[email protected]andClaude Opus 4.6	97cbe38949	fix(fuzz): address PR review — LazyLock for expensive constructors, fix assertions and docs ... - Use std::sync::LazyLock to construct Sanitizer, Validator, and LeakDetector once instead of on every fuzz iteration (they compile regex/Aho-Corasick) - Remove fuzz_config_env assertion that panics on null-byte-only input - Remove no-op length check with misleading comment in fuzz_config_env - Update fuzz_config_env description in README to match actual behavior Co-Authored-By: Claude Opus 4.6 <[email protected]>	2026-03-10 11:15:56 -07:00
[email protected]andClaude Opus 4.6	e41eb8ae33	feat: add fuzzing targets for untrusted input parsers ... Add cargo-fuzz infrastructure with 5 fuzz targets exercising security-critical code paths: - fuzz_safety_sanitizer: Aho-Corasick + regex injection detection - fuzz_safety_validator: Input validation (length, encoding, patterns) - fuzz_leak_detector: Secret leak scanning (API keys, tokens) - fuzz_tool_params: Tool parameter JSON validation - fuzz_config_env: TOML/JSON config parsing Each target exercises real IronClaw business logic with invariant assertions. Includes corpus directories and setup documentation. Co-Authored-By: Claude Opus 4.6 <[email protected]>	2026-03-09 23:05:58 -07:00