September 2026 security audit

This is the public summary for the September 2026 development cycle. The internal review covered the Rust service, Admin UI, command-line client, configuration, authentication, authorization, secret handling, audit events, and dependency posture.

Improvements completed

• Password re-verification paths now share the account's failed-attempt limit.
• Responses now include browser hardening headers, and API responses are marked as non-cacheable.
• Login redirect values are limited to safe internal paths.
• Destructive reset and restore flows clean up deleted SQLite pages where the platform permits it.
• Authorization, token scoping, CSRF checks, input validation, and audit-event redaction were covered by automated tests.

Proxy-aware cookie handling remains under review and will be reported when it is merged and verified on a public revision.

Review summary

The review found no critical or high-severity issue. Remaining work is tracked as hardening work and is reviewed before each public update. Public summaries describe completed improvements and verification results without publishing attack payloads, credentials, private deployment information, or code-level details from the internal report.

Scope and limits

The review used static inspection, dependency checks, an isolated test environment, and automated HTTP scanning. Results apply only to the documented revision and configuration. They are not a guarantee that every deployment or future change is secure.

For private vulnerability reports, use the process documented in the security model.