pip install carabiner-secFixed — --diff silently scanned nothing on Windows
Two bugs, one cause: OS-native path strings compared against forward-slash literals.
git reports .github/workflows/x.yml. pathlib on Windows produces .github\workflows\x.yml. The --diff filter compared the two, never matched, and so scanned no files at all — then reported a clean repository. A scan that reports "clean" because it examined nothing is exactly the failure this tool exists to complain about, and it shipped inside the tool.
The same cause routed every .circleci/config.yml to the Azure Pipelines parser, because the dispatch compared a native path string to the literal .circleci/config.yml.
Fixed at the boundary rather than at each comparison: Finding normalises its path to POSIX on construction, and every engine emits as_posix(). One missed comparison is a silent pass on one operating system, with no way to notice from the other.
Found by the Windows CI matrix, which was added two releases ago after Windows had been listed as "untested" for some time. It has now caught two real bugs — this one and a UnicodeDecodeError crash — in three days.
58 tests, 220 checks, Linux and Windows across Python 3.10 and 3.13.