I run browser automation inside a disposable VM
Browser automation on the homelab holds real logins, so it runs inside a disposable VM. That VM stops one kind of compromise and does nothing for another, and the design only works because those two guarantees are enforced at two different layers, not one.
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.