kdenlive+audacity: 5-MOAD scan complete; kdenlive-0009 MOAD-0005 new defect

kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
  to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
  widgets read/write the same map from the main thread — data race on project
  load. Patch: add QMutex, wrap all m_lumacache access sites.

audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.

9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).

defects/gstreamer/unit/Gstreamer0004RtspProxyPasswordTest.java

@@ -0,0 +1,83 @@
+package unit;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * CWE-312 unit test: gstreamer-0004 — RTSP proxy password logged verbatim
+ *
+ * Models gst_rtspsrc_set_proxy() in
+ * subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c line 2001:
+ *
+ *   DEFECT:
+ *     GST_LOG_OBJECT (rtsp, "set proxy user/pw from properties: %s:%s",
+ *         GST_STR_NULL (rtsp->proxy_user), GST_STR_NULL (rtsp->proxy_passwd));
+ *
+ *   Any process with GST_DEBUG="*:9" set (common during development/debugging)
+ *   exposes the HTTP proxy password in plain text in the debug log.
+ *
+ *   FIX: log only the username, never the password.
+ *     GST_LOG_OBJECT (rtsp, "set proxy user from properties: %s",
+ *         GST_STR_NULL (rtsp->proxy_user));
+ *
+ * This test verifies:
+ *   1. The defective version emits the password into the log buffer.
+ *   2. The fixed version does NOT emit the password into the log buffer.
+ */
+public class Gstreamer0004RtspProxyPasswordTest {
+
+    static List<String> logBuffer = new ArrayList<>();
+
+    static void gstLogDefective(String user, String passwd) {
+        // Mirrors: GST_LOG_OBJECT(rtsp, "set proxy user/pw from properties: %s:%s", user, passwd)
+        logBuffer.add(String.format("set proxy user/pw from properties: %s:%s", user, passwd));
+    }
+
+    static void gstLogFixed(String user) {
+        // Mirrors: GST_LOG_OBJECT(rtsp, "set proxy user from properties: %s", user)
+        logBuffer.add(String.format("set proxy user from properties: %s", user));
+    }
+
+    static boolean logContainsPassword(String password) {
+        for (String entry : logBuffer) {
+            if (entry.contains(password)) return true;
+        }
+        return false;
+    }
+
+    public static void main(String[] args) {
+        final String USER = "proxyuser";
+        final String PASSWORD = "s3cr3tP@ssw0rd";
+
+        System.out.println("gstreamer-0004 CWE-312 RTSP proxy password logging test");
+
+        // Test 1: defective version — password appears in log
+        logBuffer.clear();
+        gstLogDefective(USER, PASSWORD);
+        boolean defectExposesPassword = logContainsPassword(PASSWORD);
+
+        System.out.println("  [defect] log entry: " + logBuffer.get(0));
+        System.out.println("  [defect] password in log: " + defectExposesPassword);
+
+        assert defectExposesPassword :
+            "Defective logger should expose password in log — test setup error";
+
+        // Test 2: fixed version — password does NOT appear in log
+        logBuffer.clear();
+        gstLogFixed(USER);
+        boolean fixExposesPassword = logContainsPassword(PASSWORD);
+
+        System.out.println("  [fix]    log entry: " + logBuffer.get(0));
+        System.out.println("  [fix]    password in log: " + fixExposesPassword);
+
+        assert !fixExposesPassword :
+            "Fixed logger must not expose password in log";
+
+        // Test 3: fixed version still logs the username
+        boolean fixLogsUser = logBuffer.get(0).contains(USER);
+        assert fixLogsUser : "Fixed logger should still log the username";
+
+        System.out.println("  username still logged: " + fixLogsUser);
+        System.out.println("PASS");
+    }
+}