fix: high-priority security issues from repo-health audit (#112, #95, #117, #62, #98)

[Liohtml]

Fixes the four open High-severity repo-health/security issues plus two related Medium findings:

• [repo-health] High: IngestStep.run() calls provider.fetch() without calling authenticate() first #112 – IngestStep now calls provider.authenticate() before fetch() and raises a clear PermissionError when credentials are missing.
• [repo-health] High: LLMRouter silently falls back to a different cloud provider — PHI transmitted to unintended third party #95 – LLMRouter no longer silently falls back to a different cloud provider. Only the on-device local provider may be substituted (with a warning); otherwise selection fails loudly with a descriptive error. This prevents PHI from being transmitted to an unintended third party.
• [security] ZIP symlink members bypass path traversal check in LocalProvider._scan_zip() #117 – ZIP symlink members are rejected in LocalProvider._scan_zip(); the traversal check now uses Path.is_relative_to() instead of startswith().
• [repo-health] Medium: No ZIP bomb protection in LocalProvider._scan_zip() #62 – ZIP-bomb guards: max member count (10 000), max total uncompressed size (10 GiB), max per-member compression ratio (200×).
• [repo-health] High: JSON report serializes full unredacted PHI (name, patient_id, birth_date) with no anonymization or access control on the output file #98 / [repo-health] Medium: Output reports contain full unredacted PHI — SECURITY.md only documents log pseudonymisation #89 – New --deidentify CLI flag replaces patient name/ID/birth date with a stable SHA-256 pseudonym in JSON/PDF/HTML reports ("deidentified" marker in JSON). All report files are written with owner-only 0600 permissions. SECURITY.md now documents that the output directory must be treated as PHI.

Tests: 9 new unit tests (auth gate, symlink/traversal/zip-bomb rejection, normal ZIP still accepted, de-identified report, file permissions). Router tests updated to the new no-silent-cloud-fallback contract. 154 unit tests pass, ruff + mypy clean.

Closes #112, closes #95, closes #117, closes #62, closes #98.

🤖 Generated with Claude Code

https://claude.ai/code/session_014ywk8AWq5mgbeERmvuhcJy

---

Generated by Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 86.00000% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/medcheck/providers/local.py	80.95%	2 Missing and 2 partials ⚠️
src/medcheck/pipeline/report.py	86.66%	2 Missing ⚠️
src/medcheck/llm/router.py	90.00%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 83a4e8f3-2868-4217-a2a0-e97436f260f6

📥 Commits

Reviewing files that changed from the base of the PR and between 8426bea and 6de5da1.

📒 Files selected for processing (12)

• SECURITY.md
• src/medcheck/core/context.py
• src/medcheck/llm/local.py
• src/medcheck/llm/router.py
• src/medcheck/main.py
• src/medcheck/pipeline/ingest.py
• src/medcheck/pipeline/report.py
• src/medcheck/providers/local.py
• tests/unit/test_llm/test_router.py
• tests/unit/test_pipeline/test_ingest.py
• tests/unit/test_pipeline/test_report.py
• tests/unit/test_providers/test_local.py

🔥 Files not summarized due to errors (12)

• src/medcheck/main.py: Server error: no LLM provider could handle the message
• SECURITY.md: Server error: no LLM provider could handle the message
• src/medcheck/llm/local.py: Server error: no LLM provider could handle the message
• src/medcheck/core/context.py: Server error: no LLM provider could handle the message
• src/medcheck/llm/router.py: Server error: no LLM provider could handle the message
• tests/unit/test_pipeline/test_ingest.py: Server error: no LLM provider could handle the message
• src/medcheck/pipeline/ingest.py: Server error: no LLM provider could handle the message
• tests/unit/test_llm/test_router.py: Server error: no LLM provider could handle the message
• src/medcheck/pipeline/report.py: Server error: no LLM provider could handle the message
• src/medcheck/providers/local.py: Server error: no LLM provider could handle the message
• tests/unit/test_providers/test_local.py: Server error: no LLM provider could handle the message
• tests/unit/test_pipeline/test_report.py: Server error: no LLM provider could handle the message

---

📝 Walkthrough

[!WARNING]

Walkthrough skipped

File diffs could not be summarized.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/dependabot-maintenance-u1mdmh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}