> def tail(job_id, info):

> logs = os.path.join(cfg("builds.sr.ht::worker", "buildlogs"), str(job_id))

Depending on where your job_id comes from, you may want to ensure "logs" variable still ends up pointing a subdirectory of buildlogs. You could use a combination of os.path.abspath() and various methods for checking the common prefix.

Maybe this is only a simplified snippet, but concatenating values with external parameters without checking ng the end result can lead to unpleasant surprises in production code.