Two files are worth more than anything I could write here, so this post is mostly directions. tools/verify_release.py git clone https://github.com/ArcticFox2029/chamnan && cd chamnan python3 tools/verify_release.py It re-runs the whole suite on your machine and prints what happened on yours. 5,081 checks, 5,081 passed, 0 failed here. Your total will land near that rather than on it — some checks need a developer setup a clone does not have, so they say they were skipped instead of running, and how many depends on your OS. The half that should be identical everywhere is the second one. The reason it exists: the tool refuses to report a result at all when the suite's totals line is missing. A run that dies half way prints no failure lines, so grepping for failures reads zero over a run that stopped early. That distinction cost me a morning once. INDEX_CITED_IN_CODE.md Attached to the release. Every place in the shipped source where a defect that a research round found got fixed, linked to the commit that fixed it. 21 of them landed in this release; 722 in total. It means a claim in the notes can be followed to a diff instead of taken on trust. If you want the reason any of that matters, it is the thing this release leads with. A credential redactor had been catching password and walking straight past รหัสผ่าน, 密码, 비밀번호, كلمة المرور and six more spellings of the same word. Three of thirty cases caught. It is thirty of thirty now. The vocabulary was already in the file. Somebody had added it for reading CSV header rows and never wired it to the patterns that read an assignment — same words, one path covered, the identical path beside it missed. What I got wrong in the first fix was grouping by language. German, Italian, Dutch and Indonesian are not English and are plain ASCII; the thing that actually decides the rule is the writing system. Thai, Chinese, Japanese and Korean put no spaces between words, so a keyword joined to the next word is ordinary writing there and has to be caught. Latin, Cyrillic, Arabic and Devanagari keep boundaries, so passwordless has to be left alone. Two different rules, and the axis that separates them is not the one on the language dropdown. Then a second one, found by asking the same question a different way: a variable called secret, assigned the word secret, printed its value. So did credential, apikey, passphrase, auth, cred, keypass, storepass, passwd and secretkey. Only password was caught — an earlier exemption answered "that's a label" for every one of them and ran before the rule that would have caught it. The fix that closed password had landed on one member of a set of twelve. The test that caught the first of those asserted one example. Its replacement derives the whole credential vocabulary from the module and asserts every word in it, so a thirteenth joins on the day it is added. That is the part I would steal if I were reading someone else's release notes: assert the population, not the member. One number in here you cannot reproduce from a clone, and I would rather say so than let you find out: the recall figure is measured against a synthetic corpus built to be hard to index, and it is not in the repository. The 5,081 is reproducible. The recall number is not. There is also a new command, chamnan-schedule — name a time and your work resumes then, carrying a pointer to where the work is written down rather than a command line, because "finish what you were doing" is not something a command line can say. It is a schedule and never an auto-renew: nothing detects a limit, nothing decides on its own to resume. What are you using to catch this class of thing? I am especially interested in anyone who has found a way to test a language they do not read.