v0.329.0 (review): an app named like another app's appdata folder gets no root; USERDATA_PATH is always derived, never the app's env

Security review of 2fe6341 (same night, before any release). Both red-proofed.

controller/internal/stacks/allowlist.go

@@ -34,6 +34,10 @@ func (m *Manager) policyEnv(env map[string]string) map[string]string {
 		out[k] = v
 	}
 	out["DOMAIN"] = m.cfg.Customer.Domain
+	// Security review 2026-10-18: USERDATA_PATH is ALWAYS the controller's own derivation, never the app's env. A
+	// catalog push can add a deploy field (InjectMissingFields fills it on the next sync), so an app-env value would
+	// let a template name any folder — another app's appdata/ included — as its root. No template declares one.
+	delete(out, "USERDATA_PATH")
 	if hdd := env["HDD_PATH"]; hdd != "" {
 		out["USERDATA_PATH"] = appbackup.UserdataDir(appbackup.NamespaceRootFor(hdd, m.sysDataPath))
 	}