diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md index 299348f..5d0a2f8 100644 --- a/docs/roadmap/remediation.md +++ b/docs/roadmap/remediation.md @@ -17,6 +17,8 @@ against the [implementation plan](implementation.md) and ## Finding 1 — Native overlay symlinks bypass containment and duplicate checks +**Status** — Complete. Native overlay lookup resolves supported symlinks before containment and repeat checks. The overlay tests cover escapes, aliases in both directions, and a contained target. + **Priority P2.** The layered branch passes the inherited root and lookup base to the shared overlay loader. That loader calls `filesystemAccess.canonical`. For a native filesystem, the function stats the path and returns its lexical