This one started as a small safety net — a fresh install had just proven the release pipeline works end to end, and it seemed worth adding a guard so the install script refuses to run somewhere it could damage a real working checkout. That turned into a debugging chase, and the whole thing ended in a full audit.
The guard itself was simple. Proving it worked was not: the first test against a development box showed the fix had landed in the source but not in the copy actually running. Two separate scripts had the same underlying problem: each tried to keep its own installed copy in sync while it was executing. Both are now installed as a tiny stub that always runs the current version fresh, so nothing is asked to update itself while running.
A second, unrelated problem surfaced too: one of these scripts had been removing the dependencies needed to run tests on every automatic deploy of the development server. Also fixed and verified.
None of this affected a customer install — every fix was either development tooling or a defense that hadn’t yet been exercised for real. Along with the trial-licence fix from earlier this week (confirmed on a genuine reinstall), it felt like the right moment for a proper audit.
The audit covered everything shipped since the last one: the release pipeline, the self-service profile changes, and the permission boundary around the panel’s update mechanism. That last one turned up a narrow hardening item, which was tightened and verified, with the legitimate path still working as before.
Every published release was checked directly, not just the process that builds them, and found clean. Git history came back clean. All test suites are green, and all live servers were checked directly rather than trusted from memory.