Security and dependency notes

Version 0.0.1 is distributed as source and uses the dependency versions pinned in Cargo.lock.

Key controls include:

Argon2id for new passwords while retaining verification of imported PBKDF2 hashes;
HS256 JWT validation with bounded expiry;
request body size/deadline limits and login throttling;
escaped UI output and restrictive response security headers;
redaction of configured secrets from device-operation errors;
SSH host-key verification with accept-new or strict policy;
private data/storage permissions and a single-writer storage lock;
non-root Alpine container runtime with dropped Linux capabilities and a read-only root filesystem;
local Swagger UI without CDN dependencies.

The project patches libssh2-sys locally for audited upstream fixes. Provenance is documented in vendor/libssh2-sys/PROVENANCE.md.

The retained advisory scan artifacts are:

docs/dependency-audit.json
docs/dependency-audit-metadata.json

Third-party license text is in docs/THIRD_PARTY_NOTICES.txt.