wordpress-v0.1.7

Fixed

• Windows: the built-in Administrator account can save credentials. On the built-in
  local Administrator (common on MSP servers and jump boxes), saving credentials failed
  with token file DACL grants access to a non-owner principal (LA), and reads refused
  the saved file. The token-file permission check compared security-descriptor text
  instead of account SIDs; it now resolves each trustee to a SID first. The allowed
  principals are unchanged: your account, BUILTIN\Administrators and SYSTEM.
• Windows: a token file with a NULL DACL is now refused. A NULL DACL (no access
  control at all, so any account on the machine can read the file) written with its
  flags first, which is how Windows Server 2025 renders it, passed the check. The check
  now parses the DACL exactly and refuses anything it cannot parse.