diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..cd21e10
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,8 @@
+# Security Audit & Policy
+
+See [`docs/security-audit.md`](docs/security-audit.md) for full network security findings regarding LiteLLM, PHP2Shell (CVE-2026-109618/19), and HTTP2Shell (CVE-2026-11002/03).
+
+## Summary
+- **LiteLLM**: 100% clean (not used).
+- **PHP2Shell**: Unauthenticated apps (**BookStack**, **Kanboard**, **LinkAce**) on `.35` stopped (`docker compose down`). Remaining 8 apps shielded behind Caddy Basic-Auth.
+- **Node.js / Python**: Protected by Caddy reverse proxy.
diff --git a/docs/security-audit.md b/docs/security-audit.md
new file mode 100644
index 0000000..6618831
--- /dev/null
+++ b/docs/security-audit.md
@@ -0,0 +1,55 @@
+# Security Findings Audit (October 2026)
+
+## Summary of Recent Security Disclosures & Network Audit
+
+---
+
+### 1. 🐍 LiteLLM Supply Chain Compromise (v1.107.0)
+
+* **Status**: **0% Impact / CLEAN**
+* **Audit Findings**:
+  * LiteLLM is **not installed or running** anywhere in the environment (`.13`, `.27`, `.35`).
+  * Central LLM gateway is **OmniRoute** (Next.js/Node.js on `.13:20129`).
+  * **IoC Scan**: Scanned all hosts for malicious `.pth` / `cook.py` / `cook.pth` files. Scan returned 100% clean across all filesystems.
+
+---
+
+### 2. 🐘 PHP Core Runtime ("PHP2Shell" - CVE-2026-109618 / CVE-2026-109619)
+
+* **Status**: **ACTION TAKEN / MITIGATED**
+* **Audit Findings**:
+  * 11 containerized PHP applications run on host `.35`.
+  * **Unauthenticated Applications (Action Taken)**:
+    - **BookStack** (`bookstack.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/bookstack`
+    - **Kanboard** (`kanboard.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/kanboard`
+    - **LinkAce** (`linkace.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/linkace`
+  * **Caddy HTTP Basic-Auth Shielded Applications**:
+    - **Firefly III** (`firefly.lab.audasmedia.com.au`)
+    - **phpIPAM** (`phpipam.lab.audasmedia.com.au`)
+    - **FreshRSS** (`freshrss.lab.audasmedia.com.au`)
+    - **LibreNMS** (`librenms.lab.audasmedia.com.au`)
+    - **Spotweb** (`spotweb.lab.audasmedia.com.au`)
+    - **DokuWiki** (`dokuwiki.lab.audasmedia.com.au`)
+    - **Homebox** (`homebox.lab.audasmedia.com.au`)
+    - **Metube** (`metube.lab.audasmedia.com.au`)
+  * **Local LAN Only**:
+    - **Pi-hole Admin** (`pihole.home.lab`)
+    - **LinkStack** (`linkstack.home.lab`)
+
+---
+
+### 3. 🟢 Node.js / HTTP2Shell Stream Multiplexing (CVE-2026-11002 / 03)
+
+* **Status**: **MONITOR & UPDATE BASE IMAGES**
+* **Audit Findings**:
+  * Node.js web services (**OmniRoute**, **Outline Wiki**, **n8n**, **Paperclip AI**) sit behind Caddy reverse proxy.
+  * Caddy terminates front-end TLS/HTTP2 requests, mitigating raw HTTP/2 stream multiplexing floods to backends.
+  * Base container images should be updated when upstream maintainers release Node v20.19.0+ / v22.14.0+ / v23.9.0+ images.
+
+---
+
+### 4. 🐍 Python Runtimes
+
+* **Status**: **SAFE**
+* **Audit Findings**:
+  * **Console Portal** (`.13:8500`), **DeepSeek Harness** (`.13:3081–84`), and **Prefect** run Python 3.12 with Uvicorn in standard HTTP/1.1 mode behind Caddy.
diff --git a/portal/tools.py b/portal/tools.py
index 626d941..34edd99 100644
--- a/portal/tools.py
+++ b/portal/tools.py
@@ -127,6 +127,8 @@ def _cat() -> list[Tool]:
              "Movies, TV & music server", "https://jellyfin.lab.audasmedia.com.au", login=True),
         Tool("jellyseerr", "Jellyseerr", "media",
              "Request movies & shows", "https://jellyseerr.lab.audasmedia.com.au", login=True),
+        Tool("basketball", "Basketball", "media",
+             "Basketball stats & live scores", "https://basketball.lab.audasmedia.com.au"),
         Tool("games", "Games", "media",
              "Retro games (emulatorjs, LAN)", "https://games.home.lab", lan=True),
         Tool("metube", "Metube", "media",
@@ -248,6 +250,8 @@ def _cat() -> list[Tool]:
              "Git repositories", "https://gitea.lab.audasmedia.com.au", login=True),
 
         # ---- Portfolio (Sam's resume sites) --------------------------------
+        Tool("resume", "Interactive Resume", "portfolio",
+             "Interactive resume & portfolio", "https://resume.lab.audasmedia.com.au"),
         Tool("sam-developer", "Developer", "portfolio",
              "Resume — software development", "https://sam-developer.lab.audasmedia.com.au"),
         Tool("sam-devops", "DevOps", "portfolio",
diff --git a/todo.txt b/todo.txt
index 323e2b2..4119b66 100644
--- a/todo.txt
+++ b/todo.txt
@@ -21,3 +21,4 @@ x 2026-08-26 2026-08-26 Remove OpenWebUI - Caddy, folder, docker  +project:famil
 (B) Home dash: add a common 'Links' section with categories Media/Work/Family. Media: Spotify, Netflix. Work: mail.google.com, calendar.google.com, secure1.inmotionhosting.com/index/login, mxt.smsglobal.com/login/ +project:family-home-lab +agent:family_home_lab
 (C) Sam admin dashboard panel: add router links — netcom router http://192.168.20.1:8079/login.html (may be in Caddy) and second router http://192.168.20.254/ +project:family-home-lab +agent:family_home_lab
 (C) Send commands to LLM voice-controlled network for Home Assistant, etc. +project:family-home-lab +agent:family_home_lab
+(A) Fix PHP2Shell & HTTP2Shell security issues: update container images for BookStack, Kanboard, LinkAce, Firefly III, phpIPAM, FreshRSS, LibreNMS, DokuWiki on .35 +project:security +agent:family_home_lab