[ShadowNineX]

Outcome and linked issue

Add executable property-based fuzz coverage for the AOB pattern parser identified by Scorecard's Fuzzing finding. Three xUnit facts run 1,000 FsCheck cases each in the existing Debug and Release suites: arbitrary UTF-16 against an independent grammar, generated byte/wildcard normalization, and invalid-character insertion including NUL and unpaired surrogates.

The user-authorized GitHub ruleset change is already live: main requires an up-to-date CI / Gate from GitHub Actions and verified commit signatures. Existing PR, deletion and force-push protections remain; reviewer approvals remain optional. A fresh main Scorecard run removed the missing-status-check warning and raised Branch-Protection from 3 to 4. Its remaining review warnings are retained honestly.

Scope and architectural ownership

Client test coverage and contributor guidance only. No production parser or SDK implementation changes. Update the Scorecard workflow comment to describe the actual protection policy.

Dependencies and containing artifacts

Add test-only FsCheck 3.6.0 with PrivateAssets=all; regenerate the Abstractions test project's source and production-package lock files. The pinned SDK submodule and production SDK package version are unchanged.

Validation actually performed

Check	Evidence	Qualification	Result
CI / Gate	Run 40202940055, commit 3fd8c9fa82c89bad9d4f483c44f7537a41478ab3	Portable CI	All 16 checks passed, including SonarCloud and CodeQL
Full remote suites	Debug and Release in run 40202940055	C1 managed	2,873 passed per configuration; zero failures/skips
Abstractions tests	Debug and Release, TRX reports inspected	C1 managed	351 passed per configuration; zero failures/skips
Repository contracts	Release test project	C0/C1	172 passed
Clean solution build	Release, no-incremental; binary log	Build only	Zero warnings/errors
Source restore	Solution locked-mode restore	Dependency graph	Passed
Formatting	Changed test file and Git whitespace check	Static	Passed
Packed consumer / live host / local AOT	Not executed for this test-only change	None claimed	Not run

API and compatibility

No public API, lifecycle, experimental-API, or consumer behavior changes. Fuzz tests are bounded, offline and use stable test names; FsCheck reports seeds and shrunk counterexamples on failure. The new dependency is confined to tests.

Evidence

The three properties are ArbitraryUtf16MatchesThePatternGrammarWithoutThrowing, GeneratedBytesAndWildcardsPreservePositionsAndCanonicalText, and InvalidCharactersAreRejectedAtEveryGeneratedInsertionPoint. See CONTRIBUTING.md for the targeted command.

Scorecard's Fuzzing alert remains open until this code reaches main and a fresh scan recognizes it. Do not treat a passing portable test as native qualification. Repository age, independent human reviews, and OpenSSF badge evidence are separate and are not fabricated or dismissed by this change.

Documentation and review checklist

• Focused test-only change; no public API or ownership boundary changes.
• Test reports and actual qualification boundaries recorded; all current-head remote checks passed.
• SDK pin unchanged; affected test locks regenerated, not hand-edited.
• Contributor instructions and accurate Scorecard commentary updated.
• No automatic merge or release requested.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: CheatEngineNet/CheatEngine.Client
• Branch: main
• File: .coderabbit.yaml
• Commit: 2d7b4bf
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d8441ab1-ab5c-4565-be97-b958a4b66081

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud