[Bug] Safety flag incorrectly triggers on defensive security audits of own codebase

Bug Description
False positive on safety flag. I ran a DEFENSIVE security hardening prompt for my own product (a web app I own, pre-launch): server-side authorization checks, Polar webhook signature verification, idempotency, rate limiting, input validation, and an abuse-test checklist to verify MY OWN endpoints reject attacks. Fable 5 flagged it and switched me to Opus 4.8 mid-session. This is standard pre-launch security auditing that every responsible developer should do — flagging it punishes exactly the behavior you want developers to have. Please tune safeguards to recognize defensive audits of one's own codebase (possession context: the code being audited is in the working directory).

Continue.

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.223
• Feedback ID: a4bffb7c-59f6-4dc2-8df9-3329c47b26cf

Errors

[]