[Security] Arbitrary SQL execution via sqlRequest command

[coderabbitai]

Summary

The sqlRequest command allows arbitrary SQL execution with only a single shared password.

Affected Code

• server-services/start-services.js Lines 338-390

Vulnerability

Any client with the sqlPassword can run arbitrary SQL.

Impact

• Full database read/write/delete access

Recommended Fix

1. Disable by default; require explicit LS_ENABLE_SQL_API=true env flag
2. Require verified auth_key in addition to sqlPassword
3. IP allowlist or mTLS
4. Audit logging

References

• PR: New Blocks & Ported fancyMuzzle flash #43