v1.0.1

Update from 1.0.0

On a first run with no state file yet, 1.0.0 searched four directories for a
legacy baseline.json and adopted whatever it found as the reference snapshot.
One of those was the directory you launched the executable from — a Downloads
folder, a share, a USB stick — where writing a file needs no privilege at all.

That file is the answer to the question this tool exists to ask. A planted one
naming a process makes it read as Known; a near-empty one makes everything
read as new, which is noise you learn to scroll past. Either way the report was
written by whoever wrote the file. {} was accepted as a valid baseline, and an
import marked onboarding complete, so the first-run prompt never mentioned it.

1.0.1 searches only the executable's own directory, refuses a file that does not
look like a baseline, and shows the first-run prompt naming the file it read and
offering to replace it. SECURITY.md now enumerates this input alongside the
others.

If you are running 1.0.0, update.

Also in this release: main.rs was split into modules. A pure move, no
user-visible change.

SHA-256: A6CD3B94B22F9FC2A9B712745E4D77C6CE06410EAF01570C6E2C65BC1B6E0D76

This binary is unsigned. SmartScreen will warn on first run until the build earns reputation.

v1.0.0

A newer release is available: v1.0.1.

On a first run with no state file, this build could adopt a baseline.json
from the directory it was launched in, and that file decides what the tool
reports as normal. Writing one there needs no privilege. 1.0.1 reads only the
executable's own directory, refuses a file that does not look like a baseline,
and names the file it read in the first-run prompt.

This binary and its hash are kept unchanged for archival integrity. New
installs should use 1.0.1.

SHA-256: 675298EE41B4375C698856F81B2AE1F3E6C9CD198EB950B2731A7229F1CCC195

This binary is unsigned. SmartScreen will warn on first run until the build earns reputation.