[WIP] Create repository and add initial files

[Copilot]

• Create git-setup directory with a README and basic setup files

---

⌨️ Start Copilot coding agent tasks without leaving your editor — available in VS Code, Visual Studio, JetBrains IDEs and Eclipse.

[digitalstore2025]

Yes

[digitalstore2025]

@copilot

[chatgpt-codex-connector]

💡 Codex Review

-/qudscast-ai/backend/server.js

Lines 151 to 152 in 896f71b

	const piperCmd = `echo "${text}" | piper --model ar_JO-kareem-medium --output_file ${outputPath}`;
	await execPromise(piperCmd);

Avoid shell-expanding untrusted news text in TTS command

In the /api/generate flow, newsText is propagated into text and interpolated into exec() via echo "${text}" | piper ...; because this runs through a shell, command substitutions inside user input (for example $(...) or backticks) can execute arbitrary commands on the server. This is a remote code execution path whenever an attacker can submit crafted news content, so the command should avoid shell parsing (e.g., spawn with argv/stdin) or strictly escape input before execution.

---

-/qudscast-ai/backend/server.js

Lines 523 to 524 in 896f71b

	const jingleType = req.body.type || 'intro';
	const targetPath = path.join(JINGLES_PATH, `${jingleType}.mp3`);

Restrict jingle upload type to safe filenames

The /api/upload-jingle handler uses req.body.type directly in path.join(JINGLES_PATH, ${jingleType}.mp3) with no allowlist, so a crafted value like ../../voices/evil or an absolute path can escape the intended jingles directory and overwrite other writable files. This is a path traversal/write primitive for any caller of the upload endpoint; type should be validated against known values (e.g., intro|outro) before constructing the destination path.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".