## Security Fixes

1. Fix dangerous default configurations
   - Change DangerouslySkipPermissions default from true → false
   - Change DangerouslyBypassApprovalsAndSandbox default from true → false
   - Users now must explicitly opt-in to skip security prompts rather than opt-out

2. Fix database directory permissions
   - Change DB directory mode from 0755 to 0700
   - Restricts access to owner only (was: world-readable)
   - Database contains sensitive execution history and token data

3. Add shell path escaping in PATH configuration
   - New escapeShellPath() function prevents shell injection
   - Properly quotes and escapes special characters ($, \`, ", \)
   - Prevents shell startup failures with unusual path names

## Security Audit Summary

Identified 10 security anti-patterns in codebase:
- 2 HIGH severity: dangerous defaults, missing path validation
- 6 MEDIUM severity: file permissions, path traversal, error handling
- 1 LOW severity: hardcoded artifact names

See SECURITY_AUDIT.md for full analysis and recommendations for remaining items.

## Testing

- ✅ Code compiles without errors
- ✅ Configuration defaults now false (safer)
- ✅ DB directory uses 0700 permissions
- ✅ Shell paths properly escaped

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Add tests and documentation for backward compatibility of v0.3.1 security
fixes:

1. Config backward compatibility:
   - Old v0.3.0 configs load correctly with new security defaults
   - Dangerous flags now default to false (opt-in required)
   - Explicit flag values are preserved
   - Environment overrides still work
   - Validation rules unchanged
   - Config merging preserved

2. Database backward compatibility:
   - New database directories use 0700 permissions (stricter)
   - Old databases with 0755 permissions still work
   - Migrations are idempotent (safe to re-run)
   - Schema additions (provider column, reset times) backward compatible
   - Path expansion still works

3. Shell path escaping backward compatibility:
   - Paths without special chars continue to work
   - Proper escaping prevents shell injection
   - Path detection algorithms unchanged
   - Symlink resolution preserved

4. Documentation:
   - Migration guide explaining breaking changes
   - CHANGELOG updated with backward compat notes
   - Clear guidance for unattended execution

All tests pass. CLI interface stable for scripts/automation.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Add comprehensive bus-factor analysis to identify single-person dependencies
and code ownership concentration risks:

- internal/analysis package: git history parser, concentration metrics calculator
- Metrics: Herfindahl Index, Gini Coefficient, Top-N ownership percentages
- Risk assessment: critical/high/medium/low based on concentration and contributor count
- Database schema: store analysis results with historical tracking
- CLI command: nightshift busfactor with filtering options (date range, file pattern)
- Report generation: markdown and JSON output with recommendations
- Comprehensive test coverage: unit and integration tests
- Documentation: metrics interpretation, usage examples, best practices

Bus Factor = minimum contributors needed for 50% of commits. Helps identify
knowledge concentration risks and track sustainability over time.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

…or report

Fixed a critical bug in RenderMarkdown that prevented proper formatting of
recommendations. The original code was checking if rec[0:4] matched specific
prefixes ('GOOD', 'HIGH', 'CRIT', 'MEDI'), which failed for:
1. 'CRITICAL' (8 chars, not 4)
2. Other recommendations not starting with these prefixes (e.g., 'Pair...', 'Target...', etc.)

Changed to use bytes.HasPrefix() to properly check full keyword prefixes, ensuring:
- Risk level keywords (CRITICAL, HIGH, MEDIUM, GOOD) are correctly identified and bolded
- Other recommendations are properly formatted as bullet points
- All recommendation types render correctly in the markdown output

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>