[potiuk]

Summary

Two corrections to the backtest table in the threat model:

• fix(agent-guard): scope Segment.raw to its own tokens, not the whole command #1151 fixed a false denial: the guard matched text outside the segment it was checking. It was not a bypass, so it moves from VALID to VALID-HARDENING.
• tools/sourcehut: POST forwards Bearer token on redirect and skips the HTTPS assertion #1091 is the issue, and fix(sourcehut): assert HTTPS and reject redirects on GraphQL requests #1107 is the fix that closed it. The row now names both.

No claim, disclaimer or disposition rule changes.

Type of change

• Documentation

Test plan

• prek run --from-ref <base> --to-ref HEAD --skip workspace-pytest passes

Gen-AI disclosure

Drafted with Claude Code and reviewed by the maintainer.

🤖 Generated with Claude Code