safe read-only when using shell scripts

packages/api/src/controllers/config.js

@@ -33,6 +33,7 @@ module.exports = {
       runAsPortal: !!connections.portalConnections,
       singleDatabase: connections.singleDatabase,
       hideAppEditor: !!process.env.HIDE_APP_EDITOR,
+      allowShellConnection: platformInfo.allowShellConnection,
       permissions,
       ...currentVersion,
     };