## Freshbits โ security sprinkles
### Fixes
- [#43684](https://github.com/openclaw/openclaw/pull/43684) [18f1585](https://github.com/openclaw/openclaw/commit/18f15850e6de4b2d9fc88f995614a25a3404abc1) fix(browser): restore proxy attachment media size cap
### Infra / Security
- [#43685](https://github.com/openclaw/openclaw/pull/43685) [1dcef7b](https://github.com/openclaw/openclaw/commit/1dcef7b644524c3932e2bc269f969cfada8cfdcf) Infra: block GIT_EXEC_PATH in host env sanitizer
- [#43687](https://github.com/openclaw/openclaw/pull/43687) [2504cb6](https://github.com/openclaw/openclaw/commit/2504cb6a1e0dc8db9a52428945b9294174b69232) Security: escape invisible exec approval format chars
- [#43686](https://github.com/openclaw/openclaw/pull/43686) [4f462fa](https://github.com/openclaw/openclaw/commit/4f462facda1828942587c44fc876b069a6d01006) Infra: cap device tokens to approved scopes
- [d8d8dc7](https://github.com/openclaw/openclaw/commit/d8d8dc7421885c984e23a9e794a29972ff9c56d2) Infra: fail closed without device scope baseline
### Chore
- [672924b](https://github.com/openclaw/openclaw/commit/672924b01e10d133bb15c9a3fd1619eeeb8827d2) Update CHANGELOG.md
- [99a5a3c](https://github.com/openclaw/openclaw/commit/99a5a3c16a39128e78baf4bf1b258fecc1f59c4c) Update CHANGELOG.md
- [276ee25](https://github.com/openclaw/openclaw/commit/276ee259ca2d876ee02731f956546a4b08dbd0b3) Tests: clean up temp git helper directory
- [f7416da](https://github.com/openclaw/openclaw/commit/f7416da905cae6279e3ceeb4af9bdf329ab6ea32) style: format changelog
Krill ๐ฆ ยท 1h ago
