Strip BOM, skip self-sanitization, replace default DB password in mirror, and simplify pre-push scan to private keys only.
Bump version, document security hardening in README, add github snapshot push script with URL/login/IP sanitization for public mirror.