Please report vulnerabilities privately through GitHub security advisories instead of a public issue.

Every change runs, in CI:

• the Python tests, including static QML checks: every text element renders plain text and the panel QML references no remote URL;
• the native engine build and self-tests (theme validation, plain-text theme names, path boundaries, power sources);
• the same self-tests built with AddressSanitizer and UndefinedBehaviorSanitizer, so memory errors, leaks or undefined behaviour fail the build;
• CodeQL security-extended analysis for C++, Python and the workflows;
• zizmor for the workflows, ShellCheck for the scripts and a systemd-analyze security threshold for the root power relay;
• OpenSSF Scorecard (weekly and on main) for the repository's security practices.