# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 54 → 58 (+3.6)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 96 → 97 (+1.1)
- Architecture 98 → 98 (+0.4)
- Maturity 35 → 48 (+13.2)
- Readiness 68 → 49 (-18.9)
- Security 62 → 65 (+3.1)
- Performance 100 (new)

## Resolved (8)

- High CVE: System.Net.Http 4.3.0
- High CVE: System.Text.RegularExpressions 4.3.0
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- HostsFile.Record (cyclomatic 21) (Fabricator.Resources/HostsFile.fs)
- Release publish has no approval gate
- Secret passed as a command-line argument

## New (17)

- EntryPoint.run (cognitive 21) (Fabricator.Console/EntryPoint.fs)
- EntryPoint.run (cyclomatic 16) (Fabricator.Console/EntryPoint.fs)
- Files.file (cyclomatic 17) (Fabricator.Resources/Files.fs)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: Fabricator.Console/EntryPoint.fs (Fabricator.Console/EntryPoint.fs)
- Hotspot: Fabricator.Resources/Files.fs (Fabricator.Resources/Files.fs)
- Hotspot: Fabricator.Resources/HostsFile.fs (Fabricator.Resources/HostsFile.fs)
- ReportModule.marker (cognitive 16) (Fabricator.Console/Report.fs)
- Scattered collaborators

## Changes since last survey

- 53 commits — 48 feature/other, 5 fixes

## By area

- (root) — 15 commits
- Fabricator.Tests/Console — 13 commits
- .github/workflows — 4 commits
- Fabricator.Console/Report.fs — 3 commits
- Fabricator.Resources/Files.fs — 2 commits
- Fabricator.Secrets.KeePass/KeePassSecretStore.fs — 2 commits
- Fabricator.Tests/Fabricator.Tests.fsproj — 2 commits
- Fabricator.Tests/TestData — 2 commits
- Fabricator.Console/Commands.fs — 1 commit
- Fabricator.Console/ExecutionUi.fs — 1 commit
- Fabricator.Console/TaskExecutor.fs — 1 commit
- Fabricator.Core/PlainSecretStore.fs — 1 commit
- Fabricator.Core/SecretStore.fs — 1 commit
- Fabricator.Resources/DotNetTool.fs — 1 commit
- Fabricator.Secrets.KeePass/Fabricator.Secrets.KeePass.fsproj — 1 commit
- Fabricator.Tests/Core — 1 commit
- Fabricator.Tests/Resources — 1 commit
- Fabricator.Tests/Secrets — 1 commit

## Notable commits

- fix: (#11) Encoding: fix in the new project
- fix: (#11) ExecutionUi: fix the space behavior
- fix: (#55) UI: minor fixes
- fix: ExecutionUiTests: fix CI behavior (make same as local)
- fix: UI: minor fixes
- change: (#11) Changelog: add the KeePass secret store
- change: (#11) PlainSecretStore: drop the extra space from the prompt
- change: (#11) SecretRef: document why we need reference equality
- change: (#11) SecretStore: implement the API and plain implementation
- change: (#11) Secrets.KeePass: add a new project handling .kdbx files
- change: (#11) Secrets.KeePass: add a test
- change: (#11) Secrets.KeePass: add recycled and duplicate entries to the test databases
- change: (#11) Secrets.KeePass: check the exception type of a wrong master password
- change: (#11) Secrets.KeePass: ignore the recycle bin and reject duplicate titles
- change: (#11) Secrets.KeePass: make GetSecret thread-safe and lazy
- change: (#11) Secrets: add a Materialize convenience method
- change: (#11) Secrets: minor review adjustments
- change: (#11) Tests: replace secretOf with Secrets.OfString
- change: (#55) UI: print summary report after finishing
- change: (#92) Diffs, Report: limit the size of shown diffs
- …and 33 more