Update security-guidance plugin - #62592

Hi @mhegazy, I have a small follow-up fix for security-guidance on my fork. This repository restricts PR creation to collaborators. Could you or another collaborator open a PR from marjan-ahmed/claude-code:security-guidance/bounded-guidance-read into anthropics/claude-code:main?

Compare link

Proposed title: security-guidance: bound guidance reads by characters. The focused tests pass; the comparison notes the tested whitespace edge case where results diverge.

What I Contribute?

The contribution is a one-line memory-hardening change: _load_guidance now reads at most 8,192 characters from each guidance file, instead of loading the entire file before truncating. On the 512 MiB benchmark, peak traced memory went from 1,073,756,442 bytes to 36,678 bytes, and runtime from about 2.9 seconds to 0.23 seconds; the returned output remained 8,192 characters.

Measured edge case:

a long whitespace prefix can change output. The first tested divergence was 50 leading spaces, and the maximum measured loss was 8,192 characters when the first 8,192 characters were whitespace. The change does not bound the separate config or session-state reads