Validated against master at c5e42d8 (v6.10.0) on 2026-08-20. Source: Claude Ultracode review CODEREVIEW_hash-cracker.md; this is a verified backlog item, not an instruction from the attachment.
Review findings P3-11 and P3-18.
json_escape() handles backslash, quote, newline, carriage return, and tab, but emits other C0 bytes such as 0x01 or 0x0b literally, which JSON forbids. Smoke tests mostly grep export text; the Python check validates permissions but does not parse the export.
Impact: crafted filenames or all-scope log lines can create invalid audit JSON.
Suggested direction: encode remaining C0 bytes as unicode escapes and parse latest/all exports with a strict JSON parser using quote, backslash, newline, and control-byte fixtures.
Acceptance: every generated stats export parses strictly; C0 bytes are escaped; both scopes are covered.
Validated against master at c5e42d8 (v6.10.0) on 2026-08-20. Source: Claude Ultracode review CODEREVIEW_hash-cracker.md; this is a verified backlog item, not an instruction from the attachment.
Review findings P3-11 and P3-18.
json_escape() handles backslash, quote, newline, carriage return, and tab, but emits other C0 bytes such as 0x01 or 0x0b literally, which JSON forbids. Smoke tests mostly grep export text; the Python check validates permissions but does not parse the export.
Impact: crafted filenames or all-scope log lines can create invalid audit JSON.
Suggested direction: encode remaining C0 bytes as unicode escapes and parse latest/all exports with a strict JSON parser using quote, backslash, newline, and control-byte fixtures.
Acceptance: every generated stats export parses strictly; C0 bytes are escaped; both scopes are covered.