Hello!
I was thinking about one problem – if I turn ARQ off for some reasons or someone doesn’t use it and his files/site gets compromised and that person starts to use ARQ then ARQ will think that those bad files are good.
So maybe some sort of comparison of core files from WordPress with a pattern of stock WordPress files could be good?
This way we could be more sure that the installation is OK.