fix(ci): clear the security/detect-unsafe-regex error blocking every PR

[huyplb]

The ESLint security job (npx eslint .) has been failing on every open PR, including ones that touch nothing related — e.g. #120, which only changes index.html, vite.config.ts and a doc.

The sole error is in cloud-secrets.ts, on main:

apps/web/src/backend/modules/cloud-secrets.ts
  92:7  error  Unsafe Regular Expression  security/detect-unsafe-regex

The pattern ^\d{1,3}(\.\d{1,3}){3}$ rejects raw IPv4 vault hostnames. It is linear in practice — every quantifier is bounded and both ends are anchored — so this is a false positive from the rule's star-height heuristic. Rather than silence it with a disable comment, this states the same rule by splitting on ., which removes the construct the heuristic objects to and reads more plainly.

Behaviour is unchanged. Verified identical to the old pattern across 17 cases: valid IPv4, wrong octet counts, leading/trailing dots, over-long octets, hostnames, non-numeric octets, and the empty string.

After this, repo-wide npx eslint . reports 0 errors (50 warnings remain, and CI does not pass --max-warnings 0, so they don't fail the job).

Gates: tsc --noEmit clean, 570 tests pass.

Small and self-contained so it can go in ahead of the PRs it unblocks.

🤖 Generated with Claude Code

---

Note

Low Risk
Small refactor inside existing SSRF validation with equivalent intent; no auth or secret-resolution flow changes beyond how IPv4 hostnames are detected.

Overview
Unblocks repo-wide ESLint by rewriting raw IPv4 hostname detection in assertAzureVaultUrl (cloud-secrets.ts). The old anchored pattern ^\d{1,3}(\.\d{1,3}){3}$ triggered security/detect-unsafe-regex and failed the security job on every PR.

The check now splits the hostname on . and treats four all-numeric octet segments as IPv4; IPv6 rejection via host.includes(':') is unchanged. Validation behavior is intended to be the same for Azure Key Vault SSRF guards—no new endpoints or credential paths.

^{Reviewed by Cursor Bugbot for commit a5c83c0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ffbbd7f3-3ae3-4498-83ea-8feaa6932070)