docs(security): reconcile the review with the tree it now describes

[ojassug]

Docs only. Brings docs/security-review-2026-08-30.md into line with the tree it now describes.

Why

The report described three different trees at once and said so nowhere. Sessions 1–3 audited c4f4149 (v1.6.0); Sessions 4 and 4b falsified against 445b3ed (v1.7.3); the fixes in #53 landed on top of v1.7.3. Meanwhile F-01–F-07 still read as open while F-08 carried a ✅ FIXED marker, and five statements elsewhere had become false.

That matters more here than in an ordinary doc. The exclusion list is the gate deciding what a later session may file as a finding, so a stale row does damage in both directions: it makes fixed behaviour read as known-broken, and it makes a session skip verifying something. This repository has twice declared an audit closed on stale paperwork.

What was preserved

Nothing that constitutes evidence was edited — no finding text, no reproduction, no pass record. Verified mechanically: all 20 deleted lines are either re-emitted byte-identically or explicitly struck through with the replacement beside them.

• The seven findings rows keep their bodies verbatim and gain only the marker in the ID cell, matching how F-08 was already marked.
• Corrections are strikethroughs, which is this repository's existing convention and the reason its own retracted claims are still legible.

What was added

• A status box in the header — which tree each section describes, that all eight findings are fixed, that §3–§5 coordinates are v1.6.0, and what remains open.
• §3.1, a remediation table — per finding, naming what each fix deliberately does not cover: F-01's mutate-before-credential-check, F-06's content vector, F-07's unauthenticated markers.
• A staleness box on §1 — four exclusion-list rows are false at v1.7.3 (OX-M8, M9, M15 and H2 all shipped), plus §6 item 35's line drift.
• §9, a remediation record — the six open items, ranked.

What was corrected

§6.1's SSRF and OX-M8 entries · §6.2's F-04 POSIX caveat, closed by measurement in §8 · §6.3's OX-M8 bullet and its "these three compose" conclusion, since two of the three are now closed · §7.2's target list, which read as open work after all four targets had been taken.

One thing deliberately not decided

The unvalidated upstream base URL sits in §6.3 as a library hazard, while F-02 was filed as a Medium finding and fixed on identical reachability terms — and the URL case is the more severe of the two, delivering a live provider credential to a host the embedder names. Re-verified still live at proxy.ts:250-253.

That asymmetry is now stated plainly in three places rather than resolved, because which way it goes is a product decision rather than an editorial one.

Checks

Docs only, no source touched. 98 test files / 887 tests pass locally (2 skipped, POSIX-only file-mode assertions).

🤖 Generated with Claude Code