Add non-execution security coverage for generated effect submissions

[smcga]

Motivation

• Ensure server-side moderation/generation endpoints never execute submitted or model-generated effect code so server-side secrets cannot be exposed, and provide test + documentation to guarantee that boundary.

Description

• Add a unit test in api/effects.test.ts that POSTs a runtimeCode string which would create a global side-effect if executed, then asserts the side-effect did not run and the server stored/returned the original code text.
• Update README.md to explicitly document that moderation/generation endpoints only store/return code as text and do not run effect code on the server.

Testing

• Ran npm test -- api/effects.test.ts and the test suite passed (20 tests all green).
• Ran npm run docs:check and the effects/transitions docs checks passed (4 tests all green).

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
codexperimental	Ready	Preview, Comment	Apr 7, 2026 7:11pm