A false-positive fix for standard mode: a filename check such as .startswith(".env") is now recognized as data instead of secret-file access.
Fixed
- Fixed standard mode blocking inline interpreter code whose only secret-looking literal was the sole argument of
.startswith(,.endswith(,.startsWith(, or.endsWith(— for example a Python guard that exits before staging credential-like paths. The literal now counts as a data position even beside a command-execution name such assubprocessoropen(. A name assigned once and passed only to one of these methods is treated the same way. (#344, #345)
Changed
- Changed standard mode so a loop that filters names with
.endswith(".env")and then opens the match is allowed, matching how the same loop already behaved when written with==,in, or a tuplestartswith. Literals that are opened directly, passed as a second argument, or built through a path join still block, and strict and paranoid modes are unchanged.