[R3Dzf]

Security finding

The public /validate and /solve endpoints previously passed user-supplied gain strings to sympy.sympify, which is not intended for untrusted Python expressions.

Changes

• Replace direct sympify on request data with a limited AST-based mathematical parser (no eval).
• Support common math syntax, symbols, scientific notation, caret powers, and whitelisted mathematical functions.
• Bound input length, AST complexity and constant exponents.
• Add security and compatibility regression coverage in the existing CI matrix.
• Document supported expressions and unsupported constructs.

Validation

Wait for both Python 3.11 and 3.12 GitHub Actions jobs to pass before merge. This is a defense-in-depth change, not a claim of a full security audit.