/**
 * security/ — NodeBench MCP Security Module
 *
 * Single import for all security primitives:
 *   import { safePath, safeExec, safeUrl, redactSecrets, auditLog } from '../security/index.js';
 *
 * Addresses Reddit concern: "how many out of these 260 tools steal passwords?"
 * Answer: Zero, with this module enforcing boundaries at 4 layers:
 *   1. Path sandboxing — blocks reads outside project + sensitive files
 *   2. Command sandboxing — allow-list replaces bypassable deny-list
 *   3. URL validation — SSRF protection blocks private IPs/metadata endpoints
 *   4. Credential redaction — strips secrets from all tool outputs
 */
export { SecurityError, type SecurityErrorCode } from "./SecurityError.js";
export { type SecurityConfig, type SecurityMode, getSecurityConfig, setSecurityConfig, _resetSecurityConfigForTesting, } from "./config.js";
export { safePath, type SafePathOpts } from "./pathSandbox.js";
export { safeExec, type SafeExecOpts, type ExecResult, _ALLOWED_PREFIXES } from "./commandSandbox.js";
export { safeUrl, safeUrlWithDnsCheck, type UrlValidationOpts } from "./urlValidator.js";
export { redactSecrets, redactObject, _resetEnvSecretsForTesting } from "./credentialRedactor.js";
export { auditLog, getAuditLog, flushAuditLog, type AuditEntry, _resetAuditForTesting, } from "./auditLog.js";
