Hostinger: HOSTINGER_OS_TEMPLATE was interpolated into Python code
without validation, allowing Python code injection via env var.
Added validate_resource_name check.
Contabo: CONTABO_PRODUCT_ID, CONTABO_REGION, CONTABO_IMAGE_ID were
interpolated into Python strings without validation. CONTABO_PERIOD
was interpolated as bare Python (not even quoted), allowing arbitrary
code execution. Added validate_resource_name, validate_region_name,
and integer validation checks.
Agent: security-auditor
Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add Hostinger VPS hosting as a new cloud provider with REST API
provisioning and cloud-init support. Budget VPS starting at $4.95/mo
with hourly billing.
Implementation:
- hostinger/lib/common.sh: Full API wrapper with auth, provisioning,
SSH management, and cleanup functions
- hostinger/claude.sh: Claude Code on Hostinger VPS
- hostinger/aider.sh: Aider on Hostinger VPS
- hostinger/openclaw.sh: OpenClaw on Hostinger VPS
- hostinger/README.md: Complete usage documentation
Added to manifest.json:
- New cloud entry with API details and defaults
- 15 matrix entries (hostinger/claude through hostinger/continue)
- 3 implemented, 12 marked as "missing"
Agent: cloud-scout-2
Co-authored-by: B <6723574+louisgv@users.noreply.github.com>