Harden subprocess output handling (LOW-1, INFO-1, LOW-2)

README.md

@@ -1,23 +1,23 @@
-# Server Runner
-
-![GitHub](https://img.shields.io/badge/github-webcodr/server--runner-8da0cb?style=for-the-badge&logo=github&labelColor=555555)
-![Crates.io Version](https://img.shields.io/crates/v/server-runner?style=for-the-badge&logo=rust&color=fc8d62)
-![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/webcodr/server-runner/build.yml?style=for-the-badge)
-
-Server Runner is a little Rust programm to run multiple web servers, check until all servers are ready via a URL that returns HTTP 200 und runs a command when all servers are ready.
-
-## Installation
-
-Currently Server Runner is only available via Cargo. It will be also available
-via NPM in the near future, since NPM is available on almost any OS out there
-and it's much easier to publish than to many other package managers.
-
-### Installation via Cargo
-
-~~~ sh
-cargo install server-runner
-~~~
-
+# Server Runner
+
+![GitHub](https://img.shields.io/badge/github-webcodr/server--runner-8da0cb?style=for-the-badge&logo=github&labelColor=555555)
+![Crates.io Version](https://img.shields.io/crates/v/server-runner?style=for-the-badge&logo=rust&color=fc8d62)
+![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/webcodr/server-runner/build.yml?style=for-the-badge)
+
+Server Runner is a little Rust programm to run multiple web servers, check until all servers are ready via a URL that returns HTTP 200 und runs a command when all servers are ready.
+
+## Installation
+
+Currently Server Runner is only available via Cargo. It will be also available
+via NPM in the near future, since NPM is available on almost any OS out there
+and it's much easier to publish than to many other package managers.
+
+### Installation via Cargo
+
+~~~ sh
+cargo install server-runner
+~~~
+
 ## Usage
 
 ~~~ sh
@@ -49,6 +49,13 @@ Treat configuration files as trusted executable input. Server Runner starts each
 
 Readiness URLs are intended for local test services. Server Runner accepts only `http` and `https` readiness URLs and does not follow redirects during readiness checks.
 
+Server Runner captures and forwards child-process output defensively. Captured
+log lines are bounded in length and have control characters stripped. When
+output is echoed to your terminal, ANSI colour and style codes are preserved
+while window-title, clipboard, cursor-movement, and screen-clearing escape
+sequences are removed, so untrusted data flowing through a server's logs cannot
+manipulate your terminal.
+
 ### Example Configuration
 
 ~~~ yaml