[hideouts-io]

Problem

Native Security Analysis treated a lowercase URL substring as an exact IOC match. A longer host, path, or query could therefore produce a false exact finding, and a normalized match could export the indicator spelling instead of the URL observed in evidence.

Change

• Extract complete HTTP(S) URL tokens and compare normalized scheme, host, and default port while preserving path, query, fragment, and percent-encoded spelling.
• Reject unsupported URL indicators with an explicit native scan failure. Describe the matching semantics in the finding and methodology.
• Use the actual matched source range for the finding excerpt. Integration cases cover positive matches, longer URLs, word prefixes, meaningful case and encoding differences, unsupported schemes, and JSON report output.

Verification

• nice -n 10 swift test -j 4 -Xswiftc -warnings-as-errors --filter SecurityAnalysisTests --quiet: 13 passed.
• nice -n 10 swift build -j 4 -Xswiftc -warnings-as-errors --quiet: passed.
• nice -n 10 swift test -j 4 -Xswiftc -warnings-as-errors --quiet: 267 passed.
• nice -n 10 xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit -destination 'platform=macOS' -derivedDataPath /tmp/idt-url-equality-20261023-derived -jobs 4 build -quiet: passed. The app target retains warnings as errors.
• The documented global SWIFT_TREAT_WARNINGS_AS_ERRORS=YES override was attempted and interrupted by incompatible -warnings-as-errors/-suppress-warnings options in the third-party SwiftNIO _NIOBase64 and _NIODataStructures targets.

Hosted CI and Swift CodeQL for this candidate are pending. No native UI or physical-device workflow was exercised; the changed behavior is the local scanner and its report output. Ambiguous adjacent URL punctuation is retained, so the matcher may conservatively miss such text rather than label a different URL exact.