Security concerns: unencrypted WebSocket, path‑traversal, HTTP without TLS, mutable GitHub Actions tags

[EvanTW]

Security issues discovered

1. Unencrypted WebSocket (ws://) – may be sniffed by attackers.
2. *Path traversal via \path.join* – user‑provided input can read arbitrary files.
3. HTTP server without TLS – vulnerable to Man‑in‑the‑Middle attacks.
4. GitHub Actions mutable tags – potential supply‑chain risk.

Recommended fixes

• Switch WebSocket to wss://.
• Validate/sanitize user‑provided paths (use a safe‑join helper).
• Use HTTPS (self‑signed certs for development, proper certs for production).
• Pin GitHub Action versions by using fixed SHA hashes instead of mutable tags.

Please review and apply these changes to improve the security posture of the project.