Block a user
Bug: client_cli.c may free() a string literal for server_host
Bug/Quality: Protocol layer uses global I/O state; io_ssl is not thread-local
Bug: Transfer functions return -1, causing implementation-defined exit status
Bug: --delete manifest sending ignores send_status / send_int / send_str failures
Security: --delete follows symlinks and may delete outside destination tree
Security: TLS client lacks hostname verification
Security: TLS I/O doesn't handle SSL_ERROR_WANT_READ / SSL_ERROR_WANT_WRITE
Bug: Server leaks Config in non-multithreaded handler path
Security: zstd decompression may allocate ZSTD_CONTENTSIZE_UNKNOWN bytes
Security: Metadata restoration applies arbitrary mode bits including setuid/setgid
Security: Unbounded wire sizes enable OOM denial of service
refactor: config_create(), main(), send_files() — reduce duplication and complexity (#149, #150, #151)
Security: Path traversal allows writes/deletes outside destination root
fix: add NULL-checks and input validation in CLI argument parsing (#152)
quality: no unit tests for transport modules (TCP, SSH, TLS, Protocol)