# Security and dependency notes

Version 0.0.1 is distributed as source and uses the dependency versions pinned in `Cargo.lock`.

Key controls include:

- Argon2id for new passwords while retaining verification of imported PBKDF2 hashes;
- HS256 JWT validation with bounded expiry;
- request body size/deadline limits and login throttling;
- escaped UI output and restrictive response security headers;
- redaction of configured secrets from device-operation errors;
- SSH host-key verification with `accept-new` or `strict` policy;
- private data/storage permissions and a single-writer storage lock;
- non-root Alpine container runtime with dropped Linux capabilities and a read-only root filesystem;
- local Swagger UI without CDN dependencies.

The project patches `libssh2-sys` locally for audited upstream fixes. Provenance is documented in `vendor/libssh2-sys/PROVENANCE.md`.

The retained advisory scan artifacts are:

```text
docs/dependency-audit.json
docs/dependency-audit-metadata.json
```

Third-party license text is in `docs/THIRD_PARTY_NOTICES.txt`.