v2.26.0

2.26.0 (2026-09-29)

Bug Fixes

• config: stop writing runtime-only fields; never count test runs as installs (decf51e)
• jail: a quoted shell metacharacter no longer hides a credential read (JAIL-19) (5ddb367)
• jail: scope the JAIL-19 fix to the jail reader, restore the text rules (1686d1f)
• jail: the jail reads the raw command, as bash will run it (JAIL-19) (1de6241)
• messages: a protected file is reported as protected, not as a leak (MSG-1, MSG-2) (21e114f)
• messages: review round for MSG-1, "nothing was exposed" must be true (d879d89)
• setup: no login service in automation; fixable problems are one line (c5c71d1)

Features

• scan-repo: say what a finding means in plain words (912bad1)
• setup: first-run setup wizard for bare node9 (9f1060c)