[META] Audit Remediation Tracking

[BillyOutlast]

Audit Remediation Tracker

Master tracking issue for all adversarial audit findings.

Critical Issues (Fix Immediately)

• [CRITICAL-1] Zero-Key Database Encryption #169 - Zero-Key DB Encryption
• [CRITICAL-2] Session Cookie Missing Security Attributes #170 - Session Cookie Missing Security Attributes
• [CRITICAL-3] No Rate Limiting on Auth Endpoints #171 - No Rate Limiting
• [CRITICAL-4] Password No Max Length - Argon2 DoS #172 - Password No Max Length
• [CRITICAL-5] OIDC Open Redirect #173 - OIDC Open Redirect

High Issues (Fix This Week)

• [HIGH-1] Mass Assignment in Admin PATCH Endpoints #174 - Mass Assignment in Admin PATCH
• [HIGH-2] TOTP Timing Oracle (2 endpoints) #175 - TOTP Timing Oracle
• [HIGH-3] File Upload No Type Validation #176 - File Upload No Type Validation
• [HIGH-4] v-html Without DOMPurify (9 instances) #177 - v-html Without DOMPurify
• [HIGH-5] Container Runs as Root #178 - Container Runs as Root
• [HIGH-6] NGINX Missing Security Headers #179 - NGINX Missing Security Headers
• [HIGH-7] HSTS Disabled #180 - HSTS Disabled
• [HIGH-8] verify_client_certificate() Dead Code #181 - verify_client_certificate Dead Code

Medium Issues (Fix This Sprint)

• [MEDIUM-1] WebSocket No Per-Message Auth #182 - WebSocket No Per-Message Auth
• [MEDIUM-2] No Soft-Delete in Prisma Schema #183 - No Soft-Delete in Schema
• [MEDIUM-3] Request Size Limiter Disabled #184 - Request Size Limiter Disabled
• [MEDIUM-4] Type Safety Issues (@ts-ignore, as any) #185 - Type Safety Issues
• [MEDIUM-5] Limited Transaction Usage #186 - Limited Transaction Usage

Reference

• MASTER_AUDIT_REPORT.md: .omo/audit/MASTER_AUDIT_REPORT.md
• Fix prompt: .omo/prompts/audit-fix-execution.md