# Bounded follow-redirects security patch

The21October fresh npm audit identifies production-classified transitive `follow-redirects`1.16.0 with high-severity [array-header credential stripping](https://github.com/advisories/GHSA-q3jh-wrc6-jgq8) and [custom sensitive-header escaping](https://github.com/advisories/GHSA-8r9p-f939-6h3c) advisories. Both advisory records identify1.16.1as patched. This is a dependency finding, not evidence that Jobjakt was exploited or that its browser adapter exercises either vector.

`npm update follow-redirects --ignore-scripts --no-audit --no-fund` changes exactly one package. The only tracked dependency diff is that lock entry's version, tarball URL and integrity:1.16.0→1.16.1. Existing package ranges, Axios, frameworks, other dependencies, audit policy and the owner's temporary dev-only braces exception remain unchanged. No override or new dependency is introduced.

Fresh production audit reports0vulnerabilities. The full audit policy passes with only the previously approved dev-only braces-derived high chain accepted through31October; moderate development findings remain recorded. No additional exception is added. Two synthetic loopback contracts verify array-form Authorization/Cookie/Proxy-Authorization stripping and custom credential names containing`^`/`|`, while retaining a public header. Both pass against the installed1.16.1; no real credentials or external target is involved.

Raw pre/post audit records are `.artifacts/phase7/current/p712-final-security/` and `.artifacts/phase7/current/p712-follow-redirects/`. The bounded helper is `.artifacts/phase7/current/p712-redirect-contract.cjs`. Production build and application/browser TypeScript/lint are rerun; final whole-application/browser proof uses the patched dependency set. The active pre-patch browser candidate is interrupted and retained rather than presented as validating the new lock.

This patch does not resolve the independent runner's Python/.NET native crashes, qualify deployed identity, activate Qwen3.5or complete P5-13. Production readiness remains NO-GO independently of the owner's release authorization. No Phase8 implementation.