Round-3 audit residual R4 (INFO/LOW, not cut-blocker). The in-process VFS Read tool can read raw .git/objects blobs, but they are zlib-compressed so no plaintext secret is recoverable without decompression (which Read does not do). Information-only; noted for completeness. Would fall out of applying the same object-store deny to the VFS read path if ever desired.
Round-3 audit residual R4 (INFO/LOW, not cut-blocker). The in-process VFS Read tool can read raw
.git/objectsblobs, but they are zlib-compressed so no plaintext secret is recoverable without decompression (which Read does not do). Information-only; noted for completeness. Would fall out of applying the same object-store deny to the VFS read path if ever desired.