fix: ensure relative avatars keep small scope

scripts/validate-contributor-readmes/main.go

@@ -414,7 +414,7 @@ func parseContributorFiles(readmeEntries []readme) (
 			contributorProfileFrontmatter: yml,
 		}
 
-		if prev, conflict := frontmatterByUsername[processed.GithubUsername]; conflict {
+		if prev, isConflict := frontmatterByUsername[processed.GithubUsername]; isConflict {
 			yamlParsingErrors.Errors = append(
 				yamlParsingErrors.Errors,
 				fmt.Errorf(
@@ -534,6 +534,17 @@ func validateRelativeUrls(
 			continue
 		}
 
+		if strings.HasPrefix(*con.AvatarUrl, "..") {
+			problems = append(
+				problems,
+				fmt.Errorf(
+					"%q: relative avatar URLs cannot be placed outside a user's namespaced directory",
+					con.FilePath,
+				),
+			)
+			continue
+		}
+
 		absolutePath := strings.TrimSuffix(con.FilePath, "README.md") +
 			*con.AvatarUrl
 		_, err := os.ReadFile(absolutePath)