v0.329.0 (review): an app named like another app's appdata folder gets no root; USERDATA_PATH is always derived, never the app's env

Security review of 2fe6341 (same night, before any release). Both red-proofed.

controller/internal/privpolicy/privpolicy.go

@@ -90,10 +90,15 @@ func mustLoad(b []byte) (map[string]Entry, map[string]string) {
 		}
 		m[key(e.App, e.Service, e.Setting)] = e
 	}
+	owner := map[string]string{}
 	for app, f := range l.AppdataFolders {
 		if !oneSegment(f) {
 			panic("privpolicy: allowlist.json appdata folder of " + app + " is not one folder name: " + f)
 		}
+		if o, dup := owner[f]; dup {
+			panic("privpolicy: allowlist.json gives the appdata folder " + f + " to both " + o + " and " + app)
+		}
+		owner[f] = app
 	}
 	return m, l.AppdataFolders
 }
@@ -112,6 +117,13 @@ func AppdataFolder(app string) string {
 	if !oneSegment(app) {
 		return ""
 	}
+	// A folder the map gives to ANOTHER app is not this app's, even when this app is named like it: a catalog push
+	// adding a template called "paperless" must not get paperless-ngx's files (security review 2026-10-18).
+	for _, f := range appdataFolders {
+		if f == app {
+			return ""
+		}
+	}
 	return app
 }