# Phase 10 — Deferred Items

Out-of-scope findings discovered during plan execution. These are NOT fixed in
the current plan but are tracked here for future work.

## 10-09

- **GitHubSource struct-literal panic risk.** `GitHubSource.Sweep` dereferences
  `s.client` without a nil check (pkg/recon/sources/github.go:106). `NewGitHubSource`
  initializes `client`, so `RegisterAll` is safe, but any future caller using a
  struct literal (as sibling sources do) will panic. Fix: add
  `if s.client == nil { s.client = NewClient() }` at the top of Sweep. Siblings
  (GitLab, Bitbucket, Gist, Codeberg, HuggingFace, Kaggle) already lazy-init.