docs: add security audit findings and register Tuxedo security tasks; add Basketball and Interactive Resume cards to Family Console portal

2026-10-29 16:18:53 +11:00
parent 4968a63e37
commit 3bf3ea798f
4 changed files with 68 additions and 0 deletions
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -0,0 +1,8 @@
+# Security Audit & Policy
+
+See [`docs/security-audit.md`](docs/security-audit.md) for full network security findings regarding LiteLLM, PHP2Shell (CVE-2026-109618/19), and HTTP2Shell (CVE-2026-11002/03).
+
+## Summary
+- **LiteLLM**: 100% clean (not used).
+- **PHP2Shell**: Unauthenticated apps (**BookStack**, **Kanboard**, **LinkAce**) on `.35` stopped (`docker compose down`). Remaining 8 apps shielded behind Caddy Basic-Auth.
+- **Node.js / Python**: Protected by Caddy reverse proxy.