v3.1.37

• Taint analysis + secret scanning now run on the check path (check/scan_file/scan_changed_files/pre-commit/diff), catching two-step variable-indirection flows and hardcoded keys before commit
• New exec()/execSync() command-injection taint sink (method calls like regex.exec excluded)
• Open-redirect no longer fires on same-origin relative paths; taint/secrets skip minified bundles and test fixtures