[simbo1905]

Closes #208.

What

Adds a "Release-build hardening flags" subsection to
docs/SECURITY_ARCHITECTURE.md and its CN twin, stating the flags
xmake build-release actually applies (Linux/macOS:
-fstack-protector-strong, _FORTIFY_SOURCE=2, -fPIE/-pie;
Windows: /GS), how to verify them on a shipped binary (otool/readelf

• nm | grep stack_chk), and that debug/trace builds are intentionally
  unhardened. The docs previously described the policy ("harden the runtime")
  but not the real flags; this closes that gap.

Evidence (verified on this host)

• xmake build-release prints: release hardening flags: -fstack-protector-strong -fPIE -pie _FORTIFY_SOURCE=2
• otool -hv build/macosx/arm64/release/lunet-run → flags include PIE
• nm build/macosx/arm64/release/lunet-run | grep stack_chk →
  ___stack_chk_fail, ___stack_chk_guard
• EN/CN twins both carry the new subsection with matching content.

Refs ticket 217.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[Copilot]

🟡 Changes recommended

The security documentation still contains platform-inappropriate verification commands: macOS needs otool -hv rather than readelf, and stripped Linux releases need nm -D rather than plain nm, with matching corrections in the Chinese documentation.

2 open issues

• Use platform-specific executable inspection commands · New
• Use nm -D to verify Linux stack protection in stripped binaries · New

What changed in this PR

This documentation-only PR explains Lunet’s release-build hardening flags and how consumers can verify them, addressing the documentation gap described in issue #208.

Changes:

• Documents platform-specific hardening flags and their release-only scope.
• Adds macOS and Linux binary-verification commands.
• Adds matching English and Simplified Chinese sections.

File	Description
docs/​SECURITY_ARCHITECTURE.md	Adds release-hardening details and verification instructions.
docs/​SECURITY_ARCHITECTURE-CN.md	Adds the corresponding Simplified Chinese documentation.

_{Review effort: Balanced}