Audited the full repo and git history for credentials, command history,
game transcripts, and any other private data:
- No passwords/auto-login fields ever committed in the world file.
- mushclient_prefs.sqlite (the only DB ever committed) contains only
window-position/UI settings, nothing credential-related.
- No state/*.xml plugin state files, log files, or transcripts were
ever committed - confirmed via full git history scan, not just the
current working tree.
- Full-history grep for password/token/secret/key patterns turned up
nothing but LuaSocket's own bundled example code.
Found and fixed a real bug while auditing: .gitignore's state/ rule was
missing a newline, joining two patterns into one that matched nothing,
so state/*.xml files were untracked by luck (never staged) rather than
actually ignored. Also excluded *.log and SQLite -shm/-wal temp files
going forward, since debug logs can contain snippets of typed game
text. Cleaned up stray gitignore-pattern text that had been pasted into
state/.gitkeep by mistake.
