downloads anything via invalid versions

https://github.com/GoogleChromeLabs/jsvu/blob/614a799a485df27d57ea6f2aae55c09d68bf6cce/README.md?plain=1#L168

> only uses URLs that are controlled by the creators of the JavaScript engine or, in the case of JavaScriptCore on Linux, the port maintainers.

This is not true

---

And will attempt to create a `/GoogleChromeLabs` (controlled) dir in the fs

Please add both (1) input validation and (2) asserts before downloading / fs ops that we are operating in the correct allowed locations

Also see https://github.com/GoogleChromeLabs/jsvu/issues/159

---

Likely isn't worth a private security report. Those are not enabled in this repo settings anyway