v0.4.4: security release — 24 issues found by reviewing v0.4.3 and then v0.4.4 itself - #2

Merged

deva0x merged 7 commits into

mainfrom

fix/v0.4.4-self-review-findings

Jul 25, 2026

Commits on Jul 25, 2026

v0.4.4: fix 16 issues found by reviewing v0.4.3 (1 critical, 6 high)

deva0x
and
claude
committed
826b22d
v0.4.4: escalate lost monitoring coverage to a ranked finding

deva0x
and
claude
committed
f975010
docs: place the lost-coverage entry beside the capability guard it amends
deva0x
committed
1ceec16
v0.4.4: a SWAPPED collector tool is lost coverage too, not a note

deva0x
and
claude
committed
6c8e521
v0.4.4: fix 7 more issues, all introduced by this same fix batch

deva0x
and
claude
committed
9dccc22
v0.4.4: bound the malicious-pattern scan (my own round-2 fix was quadratic)

deva0x
and
claude
committed
27ecd27
test: make the plist argv test macOS-only, keep Linux coverage of the other half

deva0x
and
claude
committed
23ae93a