# Security Audit & Policy

See [`docs/security-audit.md`](docs/security-audit.md) for full network security findings regarding LiteLLM, PHP2Shell (CVE-2026-109618/19), and HTTP2Shell (CVE-2026-11002/03).

## Summary
- **LiteLLM**: 100% clean (not used).
- **PHP2Shell**: Unauthenticated apps (**BookStack**, **Kanboard**, **LinkAce**) on `.35` stopped (`docker compose down`). Remaining 8 apps shielded behind Caddy Basic-Auth.
- **Node.js / Python**: Protected by Caddy reverse proxy.