Language

Builds with the full toolchain, ships only production dependencies, and runs as a non-root user.

Matches a date, optionally with a time and a zone. Deliberately strict about separators.

Blocks inline script and restricts everything to the origin. Tighten from here rather than loosening from nothing.

Running make with no arguments prints every target that carries a comment.