- On Linux provider keys were written under the plain umask despite a
comment promising owner-only permissions. The directory is created
0700 and the file 0600, the temp file before the rename too, and the
plain-text fallback is stated where it lives, including in the
settings pane copy.
- A release build has no console, so every eprintln wrote into nothing.
A small logger appends timestamped lines to codeburn.log under the
app's local data directory, rolls at 256 KB, and keeps stderr in
debug builds. All call sites use it.
- Uninstall left the launch-at-login Run value pointing at a deleted
exe, so Windows errored at every login. A WiX fragment removes that
one value on a real uninstall, not on upgrade. User data under the
config directory is kept on purpose and the fragment says why.
- The webview CSP allowed a host nothing in the page contacts.
- The updater's verification site now states its trust boundary: the
hash and the MSI come from the same release, so the check proves
transfer integrity only. Signing is a release decision.
