chore(release): v8.1.2 — node_modules and plugin dir foreign, posture credit honest

Version sync: package.json, .claude-plugin/plugin.json, README badge +
Recent versions row, CLAUDE.md header + v8.1.2 highlights, CHANGELOG
[8.1.2]. The own-working-tree header and CHANGELOG no longer claim that
node_modules and the plugin dir are the only install locations foreign
code lands in (independent review: Python venv, vendor/ still own) —
listed as Known open instead.

Gates on the staged tree: suite 2328 / 2322 pass / 0 fail / 6 skipped,
hooks 370/0, golden 109/7/4 61/61, av-surface 6/6, claude plugin
validate pass (1 known CLAUDE.md warning).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -6,7 +6,7 @@ Security scanning, auditing, and threat modeling for Claude Code projects. OWASP
 
 *AI-generated: all code produced by Claude Code through dialog-driven development. Every change is human-directed, reviewed, and validated before commit. Per Anthropic Consumer Terms §4, ownership of outputs is assigned to the user; this plugin is licensed MIT.*
 
-![Version](https://img.shields.io/badge/version-8.1.1-blue)
+![Version](https://img.shields.io/badge/version-8.1.2-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
 ![Scanners](https://img.shields.io/badge/scanners-22-cyan)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
@@ -779,6 +779,7 @@ line if you run those. A sparse checkout of your own clone does not change what
 
 | Version | Date | Highlights |
 |---------|------|------------|
+| **8.1.2** | 2026-09-22 | **Installed packages and plugin copies are foreign.** A target reached through a `node_modules` folder below the working directory, or one under the Claude Code plugin directory (`$CLAUDE_CONFIG_DIR/plugins`, default `~/.claude/plugins`), no longer counts as the caller's own tree, so its `.llm-security-ignore` and `.llm-security/policy.json` are ignored. The posture scanner gives NIST "Govern" credit for a `policy.json` only when the scan would honour it. Known open: a `git archive` export or unpacked tarball under the working directory, and install locations the rule does not name (a Python virtual environment, a `vendor/` folder), still count as own. Detection tables and hooks unchanged. 2328 tests, 0 fail. |
 | **8.1.1** | 2026-09-22 | **Own-tree rule narrowed, v8.1.0 follow-ups.** A clone, submodule or worktree that sits *under* the working directory no longer counts as the caller's own tree, so its `.llm-security-ignore` and `.llm-security/policy.json` (incl. custom SIG rules) are ignored — the target must share the working directory's git root. `ci.failOn` / `ci.compact` in `policy.json` now have a real test. The README no longer states self-scan counts that change with every commit. Windows/Defender quarantine is still not measured. Detection tables and hooks unchanged. 2306 tests, 0 fail. |
 | **8.1.0** | 2026-09-22 | **Antivirus surface.** Clone and install on Windows without Defender quarantining a file, with detection unchanged. No payload sits on disk as a file that would run it: test fixtures are built in a temp directory at test time, the malicious-skill demo ships encoded and is materialized on demand, and `tests/av-surface.test.mjs` fails the suite if a payload comes back. Skill-scanner detection lists moved from the agent file to `knowledge/`. New section [Antivirus false positives](#antivirus-false-positives). Scope fixes: a scanned repository's own `.llm-security-ignore` and `.llm-security/policy.json` are honoured only when it is your own working tree, so a foreign clone cannot suppress its findings or raise its thresholds. Remote scans accept HTTPS URLs on any host. Signature tables and golden baseline untouched. 2286 tests. |
 | **8.0.0** | 2026-09-18 | **Breaking cleanup + detection tables on vendored commons data.** BREAKING: the four `LLM_SECURITY_*` mode env-vars deprecated in v7.3.0 are removed (`.llm-security/policy.json` is the only source; a removed variable is inert) and `riskScoreV1()` is deleted — see [Migrating to v8.0.0](#migrating-to-v800). The injection lexicon (83 patterns), codepoint carriers, `OWASP_MAP`, the 19 fixed secret shapes and the 7 SIG signatures are now built from the pull-only `scanners/commons/` subtree, each swap proven content-identical against a golden baseline; an unresolvable lexicon fails loudly on stderr instead of scanning with zero patterns. Fixes: `<script>` recall hole, two quadratic `hybrid-xss` patterns (whole-table ReDoS gate added), Yarn Berry + nested lockfile-v1 misses in `supply-check`, a second-occurrence strip miss in `content-extractor.mjs`, bare legacy OpenAI keys, a malformed-SIG-rule false-positive matcher, SARIF multi-OWASP tags. Commons conformance spec 1.1 implemented. 2253 tests. |