- #8: do not import MultiMC PreLaunch/Wrapper/JVM overrides from packs - #9: filter dangerous +jvmArgs from MultiMC patches / lwjgl3ify - #10: cap HTTP body reads at 16 MiB - #11: guard FileUtils.copyDirectory against path escape - #12: allow only http/https/mailto in openLink - #13: follow authlib api-location only on same-host HTTPS