Historial de auditorías

Most static alerts are false positives caused by defensive examples, readable Chinese prose, Markdown syntax, SVG paths, and documented installation locations. One high-risk behavior is confirmed: claim-check executes claims-file commands through shell=True, so hostile or insufficiently reviewed input can run arbitrary code. Static review was capped at 400/554 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

The audit confirms one high-risk issue: scripts/claim-check.py executes commands from an untrusted claims file with shell=True. The other reviewed matches are false positives from documentation, defensive patterns, test harnesses, installer mechanics, or static-site content; the confirmed issue requires remediation before publication. Static review was capped at 400/536 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.