first commit

docs/security.md

@@ -0,0 +1,26 @@
+# Security and dependency notes
+
+Version 0.0.1 is distributed as source and uses the dependency versions pinned in `Cargo.lock`.
+
+Key controls include:
+
+- Argon2id for new passwords while retaining verification of imported PBKDF2 hashes;
+- HS256 JWT validation with bounded expiry;
+- request body size/deadline limits and login throttling;
+- escaped UI output and restrictive response security headers;
+- redaction of configured secrets from device-operation errors;
+- SSH host-key verification with `accept-new` or `strict` policy;
+- private data/storage permissions and a single-writer storage lock;
+- non-root Alpine container runtime with dropped Linux capabilities and a read-only root filesystem;
+- local Swagger UI without CDN dependencies.
+
+The project patches `libssh2-sys` locally for audited upstream fixes. Provenance is documented in `vendor/libssh2-sys/PROVENANCE.md`.
+
+The retained advisory scan artifacts are:
+
+```text
+docs/dependency-audit.json
+docs/dependency-audit-metadata.json
+```
+
+Third-party license text is in `docs/THIRD_PARTY_NOTICES.txt`.