v0.5.17

Security

• A provider token written as a JSON key or before a colon ("ghp_…": …, ghp_…:x-oauth-basic) was taken for the variable's name, and the whole token could reach the report as that name. A name that looks like a token is now dropped.
• New release key. SHA256SUMS will be signed on the maintainer's Mac with a key kept behind Touch ID, never in CI. This release trusts the new key and the previous one; the next release is the first signed with the new key and trusts it alone, and the CI secret is then deleted. Keep installed copies updating (the default) so they follow.
• On macOS, an update must be signed by the same Developer ID team as the running copy before it runs, and install.sh checks the binary's Developer ID before running it.
• Rulesets now forbid moving or deleting release tags and force-pushing main.

bordercheck full-scan -verify asks each provider whether the tokens found still work (GitHub, OpenAI, Anthropic, Stripe, Slack, npm): each token goes only to the provider that issued it, with a read-only request that costs nothing, and each finding then says LIVE, dead or unknown. Off unless asked for; the hourly check never does it.

Docs: a threat model (docs/threat-model.md) and a security policy (SECURITY.md): private reporting is on, with a US$100 bounty for confirmed vulnerabilities in scope. The README no longer says that no location is ever sent (include_location can send one).