Signs-of-compromise section cited a legit cron job as suspicious

The unauthorised-access findings flagged one of my own backup cron entries as a possible backdoor. It's signed and documented. False positives like that undermine confidence in the real findings.