Security Findings Audit (October 2026)

Summary of Recent Security Disclosures & Network Audit

Status: 0% Impact / CLEAN
Audit Findings:
- LiteLLM is not installed or running anywhere in the environment (.13, .27, .35).
- Central LLM gateway is OmniRoute (Next.js/Node.js on .13:20129).
- IoC Scan: Scanned all hosts for malicious .pth / cook.py / cook.pth files. Scan returned 100% clean across all filesystems.

Status: ACTION TAKEN / MITIGATED
Audit Findings:
- 11 containerized PHP applications run on host .35.
- Unauthenticated Applications (Action Taken):
  - BookStack (bookstack.lab.audasmedia.com.au) -> STOPPED via docker compose down in /Docker/Containers/bookstack
  - Kanboard (kanboard.lab.audasmedia.com.au) -> STOPPED via docker compose down in /Docker/Containers/kanboard
  - LinkAce (linkace.lab.audasmedia.com.au) -> STOPPED via docker compose down in /Docker/Containers/linkace
- Caddy HTTP Basic-Auth Shielded Applications:
  - Firefly III (firefly.lab.audasmedia.com.au)
  - phpIPAM (phpipam.lab.audasmedia.com.au)
  - FreshRSS (freshrss.lab.audasmedia.com.au)
  - LibreNMS (librenms.lab.audasmedia.com.au)
  - Spotweb (spotweb.lab.audasmedia.com.au)
  - DokuWiki (dokuwiki.lab.audasmedia.com.au)
  - Homebox (homebox.lab.audasmedia.com.au)
  - Metube (metube.lab.audasmedia.com.au)
- Local LAN Only:
  - Pi-hole Admin (pihole.home.lab)
  - LinkStack (linkstack.home.lab)

Status: MONITOR & UPDATE BASE IMAGES
Audit Findings:
- Node.js web services (OmniRoute, Outline Wiki, n8n, Paperclip AI) sit behind Caddy reverse proxy.
- Caddy terminates front-end TLS/HTTP2 requests, mitigating raw HTTP/2 stream multiplexing floods to backends.
- Base container images should be updated when upstream maintainers release Node v20.19.0+ / v22.14.0+ / v23.9.0+ images.

Status: SAFE
Audit Findings:
- Console Portal (.13:8500), DeepSeek Harness (.13:3081–84), and Prefect run Python 3.12 with Uvicorn in standard HTTP/1.1 mode behind Caddy.