build: enable address/undefined sanitizer build target and add -Wpedantic -Wshadow -fstack-protector-strong flags

Makefile

@@ -3,7 +3,8 @@
 
 # Compiler settings
 CC = gcc
-CFLAGS = -Wall -Wextra -O2 -I./include
+CFLAGS = -Wall -Wextra -Wpedantic -Wshadow -O2 -I./include
+CFLAGS += -fstack-protector-strong -D_FORTIFY_SOURCE=2
 LDFLAGS = -lX11 -lXext -lXinerama -lXrandr -lXft -lfontconfig -ldbus-1 -lcurl -lm -lpthread
 
 # Directories
@@ -42,7 +43,7 @@ endif
 # MAIN TARGETS
 # =============================================================================
 
-.PHONY: all help clean install uninstall debug run test deps check-deps
+.PHONY: all help clean install uninstall debug sanitize run test deps check-deps
 
 # Default target - show help if first time, otherwise build
 all: check-deps $(TARGET)
@@ -69,6 +70,7 @@ help:
 	@echo "ALL COMMANDS:"
 	@echo "  make          - Build DWN (release version)"
 	@echo "  make debug    - Build with debug symbols"
+	@echo "  make sanitize - Build with address/UB sanitizers"
 	@echo "  make run      - Test in Xephyr window (safe!)"
 	@echo "  make install  - Install to $(BINDIR)"
 	@echo "  make uninstall- Remove from system"
@@ -91,6 +93,13 @@ debug: CFLAGS += -g -DDEBUG
 debug: clean $(TARGET)
 	@echo "Debug build complete!"
 
+# Build with address and undefined behavior sanitizers
+sanitize: CFLAGS += -g -fsanitize=address,undefined -fno-omit-frame-pointer
+sanitize: LDFLAGS += -fsanitize=address,undefined
+sanitize: clean $(TARGET)
+	@echo "Sanitizer build complete!"
+	@echo "Run with: ASAN_OPTIONS=detect_leaks=1 ./$(TARGET)"
+
 # Link all object files into final binary
 $(TARGET): $(OBJS) | $(BIN_DIR)
 	@echo "Linking..."