Catch Windows/Linux/macOS-only defect classes before push: raw std::jthread, sqlite3_open* via bare path.c_str(), and raw getenv reads outside the config boundary. Wired into pre-commit and the unit/policy suite; 575 reviewed sites allowlisted.
Keep hook checks read-only and staged paths NUL-delimited. Use the default OpenGrep profile locally while retaining audit scans for CI.
Signed-off-by: trvon <me@trevon.dev>
