Closure audit (2026-07-17 05:50): all 37 still-open SonarQube vulnerabilities on the backend are accounted for — none unexamined. 13 are stale SpikerSoft.Api/appsettings.json lines whose secrets…
Adding a third noise-family to the proposal from continued triage: S1075 'hardcoded URIs/paths' (74 findings). Sampled sites are dominated by deliberate constants — /var/run/docker.sock in…
Resolved in spikersoft-backend PR #343 (merged to master). The five strict-mock tests now assert their never-called contract explicitly via VerifyNoOtherCalls(); the sixth S2699 finding (EnglishSou…
Resolved in spikersoft-backend PR #344 (merged to master). RemediationActions.SafeSet (the host auto-remediation allowlist) and SpellDefinitions.Spells are frozen collections now; GameEventsConsume…
Resolved in spikersoft-backend PR #342 (merged to master). The three S6677 duplicate-placeholder templates are reworded (unbound holes no longer render literally in the Python-probe and art_pipe…
PR #341 got merged after commit 1 only (the host pin + unmasking); the LLama-test exclusion and master-only-trigger commits missed that merge. Re-landed via PR #345 (merged). The post-merge master…
Resolved in spikersoft-angular PR #221 (merged to master). Full social reading frontend: social models + ReaderService methods, the profile Social tab (hidden for excluded accounts), and the…
Resolved in spikersoft-backend PR #340 (merged to master, 360828c). Social reading backend: ProfileSocial opt-ins, the ISocialVisibilityService choke point (child/minor hard-excluded via…
Third commit on PR #341: dropped the pull_request trigger entirely (master push + workflow_dispatch only). Two independent reasons, both verified: (1) Community Edition submits PR-event scans as…
Added a 6th item to PR #344: JsonPacketSerializer's S3923 BUG — an if/else whose branches were byte-identical (both set dict["type"] = GetEventTypeName(evt)). Collapsed to one unconditional…