- Add NULL-checks for all str_dup() calls in argument parsing
- Replace atoi with strtol + endptr validation for port numbers
- Add errno/endptr validation for strtoull calls (--max-size, --min-size)
- Check str_dup result for exclude/include patterns, server-host, backup-dir
- Validate positional directory arguments for allocation failure
