docs(audit): consolidate the three independent v3.8.55 reviews

[LMPrado-DZ23]

The release gate requires three independent audits with their findings consolidated. This is that record for release/v3.8.55.

Three auditors ran in parallel — architecture, offensive security, product/QA — each in its own worktree, without access to the others' conclusions, and each required to git fetch and re-verify every finding against the current tip before reporting. The tree advanced under them (#53, #56, #64, #65, #66 merged mid-audit); all three confirmed by diff which of their findings survived.

Auditor	CRITICAL	HIGH
A — architecture	0	1
B — security	1	1
C — product/QA	0	1

What the section records that a summary would lose

• The CRITICAL, and that I missed it. /v1/** answered anonymous internet callers because requireLogin governs /api/** only — and the VM deployment guide prescribed REQUIRE_API_KEY=false for a public domain. My own 3.8.54 smoke test probed /api/** and GET /v1/models (gated by a different switch) and reported the image closed. That is written down.
• The HIGH that is still open. No full-CI verdict exists for this line at any commit; three sweeps died at exit 143 with no output. ci(release-green): a killed sweep must still say which gate it was in #70 makes the next one diagnosable and does not close it. The section says so.
• Auditor C revising itself from MEDIUM to HIGH after discovering its earlier evidence came from a stale log — kept, because an audit that corrects itself is worth more than one that is right by luck.
• Auditor B's disclosure that one probe made real upstream calls to opencode's free tier. Unexpected, and itself the headline finding.
• Every MEDIUM/LOW still open, including B-M1: behind a reverse proxy, anyone on the internet can lock the owner out of their own dashboard indefinitely. Deliberately not rushed — re-keying the lockout trades a guaranteed DoS for a possible brute-force hole, and the right answer is probably two counters with different ceilings.
• What could not be tested, unrounded: no real provider was connected, so live routing and real spend roll-up are untested; and /dashboard/costs/workspaces would not render in auditor C's browser — not reported as a finding, because an untouched sibling page fails the same way, but flagged for the owner to confirm, with the consequence stated if it does not.
• The negative space: npm audit --omit=dev 0 vulnerabilities across 890 production deps, 314/314 authz tests, IDOR attacked from several angles without a hole, Host-spoofing and path-normalisation bypasses tried and failed.

Gate	Result
check:doc-links	PASS
check:fabricated-docs	clean
prettier --check	clean

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 30ab14e3-accc-4ecf-a3ca-e59e0e3a6486

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}