fix: measure VCS consumption honestly (#1345, #1344) + v1.5.0 audit fixes (#1343)