docs: say what the path and input checks do

[kkdev92]

Makes SECURITY.md describe the path and input checks as the code does them.

Why

SECURITY.md said that the save directory "cannot be absolute or contain .." and that file name patterns "cannot contain shell metacharacters". Neither is refused: validateSaveDirectory and validateFileNamePattern feed the configuration warnings in the ClipShot log. The protection is real but elsewhere, and the page should point at it rather than at the warnings.

• src/image/file-writer.ts calls validatePathInsideWorkspace on the target file before writing it (writeAtomic) and on a folder before creating it (ensureDir).
• validatePathInsideWorkspace resolves the workspace root and the existing part of the target through realpath, then refuses a path whose relation to the root starts with .. or is absolute.
• The save path is path.join(workspaceRoot, saveDirectory, fileName) (src/image/path-generator.ts), so a .. that stays inside the workspace resolves to the folder it names.
• sanitizeFileName (src/security/sanitizer.ts) removes control characters and < > : " / \ | ? * from each generated name, and on Windows prefixes a reserved name; it leaves other shell metacharacters, which only the warning reports.

Change

• Path Traversal Prevention: the saved image and the folders created for it are checked to be inside the workspace; links are resolved through the part of the path that exists; a save directory that leads outside is refused when the image is saved. The code sample follows validatePathInsideWorkspace.
• Input Validation: numeric values are clamped, a value of the wrong type falls back to the default, the save-directory and file-name-pattern checks are warnings, and file names are sanitized as above.
• The comment in sanitizeConfiguration no longer claims a filter on fileName.pattern that the code does not apply.

Verification

• npm run lint, npm run compile, the configuration tests.
• Each statement checked against the source named above. The README's own Security and Privacy section already describes the workspace check as it is and is unchanged.

🤖 Generated with Claude Code