Summary

• Hash sensitive admin role log identifiers instead of logging raw OpenID/admin document ids.
• Pin GitHub Actions dependencies to commit SHAs and ignore local .gstack security reports.
• Reduce repeated profile/my-post/activity scans to single-pass counting paths.
• Mark the package as ESM to avoid Node script reparsing warnings.

Verification

• PATH=/Users/bytedance/.nvm/versions/node/v20.19.2/bin:$PATH npm run check
• git diff --cached --check
• Previous audit checks recorded in harness/claude-progress.md: syntax checks, performance guards, npm audit for root and cloudfunctions, secret/security scans.

Known gaps

• WeChat DevTools service port 9420 remains blocked, so real DevTools/real-device UI and performance acceptance were not executed.