Module code_security 

Optional licensed hints over a caller-admitted source snapshot. Detection remains private; the public host validates bounded findings and owns wording.

Functions

enabled_for

note

Never opens a path. The caller supplies the same safe source snapshot used by the read, before compression, and rechecks source/output authority later. The note is not a security verdict and must not be stored in source caches.