Security review

The 18 item checklist and where it stands: all eight P0 items pass, three lower items are still open.

Checklist SEC-01 to SEC-18. Each item is PASS, FAIL (with an issue link), ACCEPTED (a risk kept on purpose, with a justification) or N/A. A P0 FAIL blocks submission. The reviewer of an item is never its author. Status OPEN means nobody has signed the item off yet.

ID	Priority	Area	Status	Automated check
SEC-01	P0	Access control on auctioneer actions	PASS	`packages/e2e/test/security/access.test.ts`
SEC-02	P0	Bidder identity and token binding	PASS	`access.test.ts`
SEC-03	P0	Webhook authenticity	PASS	`webhook.test.ts`
SEC-04	P0	Secrets in repo, logs and bundle	PASS	gitleaks workflow, bundle scan
SEC-05	P0	Sandbox-only guard and boot validation	PASS	`sandbox.test.ts`
SEC-06	P0	Money integrity (integer cents, ledger)	PASS	engine and payments tests
SEC-07	P0	Injection and rendering of untrusted text	PASS	`fuzz.test.ts`
SEC-08	P1	Abusive input caps	PASS	`abuse.test.ts`
SEC-09	P1	CORS and origin allowlist	PASS	T-QA-075
SEC-10	P1	Transport and security headers, CSP	OPEN	`headers.test.ts`, web `network.spec.ts`
SEC-11	P1	Audio and personal data	ACCEPTED	manual review
SEC-12	P1	Dependency risk	PASS	`audit.yml`, `audit-waivers.json`
SEC-13	P1	SSRF	PASS	`webhook.test.ts` (certificate URL host allowlist)
SEC-14	P1	Denial of service on the parse path	PASS	`dos.test.ts`
SEC-15	P2	Logging hygiene	OPEN	log scan after scenario S01
SEC-16	P2	Admin and ops pages	PASS	manual review
SEC-17	P2	Clickjacking and PayPal return URL redirect	OPEN	manual review
SEC-18	P0	Server time is authoritative	PASS	T-QA-079

docs/SECURITY-REVIEW.mdthe checklist and how to record a result