fix(security): resolve CodeQL code alerts

[cl-efornaciari]

Summary

Resolves 5 CodeQL code alerts (2 go/log-injection, 3 js/empty-password-in-configuration-file).

Alerts Addressed

#	Rule ID	Severity	File:Line	Status
324	go/log-injection	high	ops/localenv/main.go:101	FIXED
325	go/log-injection	high	ops/localenv/main.go:112	FIXED
320	js/empty-password-in-configuration-file	high	.helm-repositories.yaml:10	FIXED
321	js/empty-password-in-configuration-file	high	.helm-repositories.yaml:19	FIXED
322	js/empty-password-in-configuration-file	high	.helm-repositories.yaml:28	FIXED

Fixes Applied

go/log-injection (CWE-117)

• File: ops/localenv/main.go
• Change: Added sanitizeForOutput() helper that escapes backslashes, carriage returns, and newlines before passing subprocess stdout/stderr to fmt.Print. Prevents log injection when output is captured (e.g., in CI).
• Behavior: Subprocess output (docker build, go test) now displays newlines as literal \\n to prevent forged log entries. Local dev tool; security fix takes precedence over formatting.

js/empty-password-in-configuration-file

• File: .helm-repositories.yaml
• Change: Removed password: '' and username: '' from all three repository entries (bitnami, chainlink-qa, grafana). These are public chart repositories that do not require authentication. Helm allows omitting optional credentials for public repos.

How changes were made

• Go: Sanitized user-controlled subprocess output before logging per CWE-117 guidance (escape newlines).
• YAML: Removed empty credential fields from Helm repo config; public repos do not require them.
• No false positives; all alerts addressed with targeted changes.

Build Verification

• go build ./ops/localenv/ succeeds

Made with Cursor

[github-actions]

👋 cl-efornaciari, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

[cl-sonarqube-production]

Quality Gate passed

Issues
0 New issues
1 Fixed issue
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[github-actions]

This PR is stale because it has been open 30 days with no activity.
Remove the stale label or comment or this will be closed in 7 days.

[github-actions]

This PR has been automatically closed because it has been stale for > 30 days.
If you wish to continue working on this PR, please reopen it and make any necessary changes.