v0.5.14

The same code as v0.5.13, released again with what v0.5.13 lacked: its macOS binaries are signed with Developer ID and notarized, and the notification app is included. (v0.5.13's macOS binaries were only signed ad hoc, because notarization did not run; they work when installed with install.sh or Homebrew and when BorderCheck updates itself, and v0.5.13 had no notification app, so Macs that updated to it kept their current one.)

From v0.5.13: cloud CLI sign-ins are information. Azure CLI's token cache and gcloud's credential store and application default credentials are kept in plain text by the CLIs by design, and signing out revokes them. The secrets check lists them for information, with how to sign out (az logout, gcloud auth revoke, gcloud auth application-default revoke) in its summary, instead of warning. Long-lived secrets (a service principal's secret, a service account key file) still warn. Policy: checks.secrets.cli_sign_ins_info (default true).