GHSA-m8pg-chhv-hxvq (CWE-200, advisory severity low): `ahoy doctor --json` leaks absolute home paths in the `history.path_stale` gap. `internal/core/ahoy/apply.go:auditGaps` composes the gap's Detail from two raw absolute paths — `entry.Path` from `~/.abcd/history/index.json` and `filepath.Abs(cwd)` — while every other path-bearing gap in the package (`detectPathSymlink`, `detectShadowedEntry`, `detectBinDirOnPath`) routes through `displayPath` (`fsutil.RedactHome`) precisely so a gap pasted into an issue carries no username. Text-mode doctor prints counts only; `--json` encodes the whole DoctorReport raw. Reproduced at v0.7.0 (8f68ffb3): register a repo, move it, `ahoy doctor --json` prints both paths in full. The fix must establish that both paths render through `displayPath` and that doctor's JSON output carries no home prefix; a foreign machine's home in `entry.Path` (a different username in a cross-machine registry) is not this advisory's scope.

GHSA-m8pg-chhv-hxvq (CWE-200, advisory severity low): ahoy doctor --json leaks absolute home paths in the history.path_stale gap. internal/core/ahoy/apply.go:auditGaps composes the gap's Detail from two raw absolute paths — entry.Path from ~/.abcd/history/index.json and filepath.Abs(cwd) — while every other path-bearing gap in the package (detectPathSymlink, detectShadowedEntry, detectBinDirOnPath) routes through displayPath (fsutil.RedactHome) precisely so a gap pasted into an issue carries no username. Text-mode doctor prints counts only; --json encodes the whole DoctorReport raw. Reproduced at v0.7.0 (8f68ffb3): register a repo, move it, ahoy doctor --json prints both paths in full. The fix must establish that both paths render through displayPath and that doctor's JSON output carries no home prefix; a foreign machine's home in entry.Path (a different username in a cross-machine registry) is not this advisory's scope.

Grounds

• pursued: routing the two paths through the package's one redactor is the whole fix; the surface test proves no other field of doctor's JSON leaks the home prefix, which would show the fix incomplete