[security] M-11: Broad privileged file access for advocate/trainer roles

[jacobyoby]

Severity: Medium
File: files/common.py:11

Problem

Advocate and trainer roles have overly broad file access privileges.

Remediation

Apply principle of least privilege. Restrict file access to only what each role requires.

Source

Finding from security audit (2026-08-31). See .github/SECURITY_AUDIT_TRIAGE.md.