- Fix path traversal vulnerability in TVDB cache (CWE-22) - Support TVDB_API_KEY env var to avoid hardcoded secrets - Add config.json to .gitignore, remove from git history - Add pyproject.toml for proper packaging, remove sys.path.insert - Add file hash to duplicate detection (reduce false positives) - Require --force flag for --auto-delete-duplicates deletion - Log deletions to recovery manifest - Create .env.example template