Internal audit status
Review the security, accessibility, browser-resilience, and supply-chain findings and remediations from Ownfold's 2026-08-03 internal audit.
The 2026-08-03 internal audit found and remediated vulnerable documentation dependencies, expanded the dependency gate to include build tooling, pinned workflow dependencies, enabled dependency trust-downgrade checks, added upstream cryptographic vectors, shortened temporary secret lifetimes, and hardened parser and JSON boundaries.
The framework follow-up upgraded Next.js and locked patched Sharp/PostCSS releases after new advisories appeared. It also replaced post-buffer Web JSON limits with bounded streaming readers and hardened production example origins, record identifiers, error mapping, caching, and response headers.
Current result
| Area | Result |
|---|---|
| Full dependency audit | No known vulnerabilities |
| Trivy including development dependencies | No medium, high, or critical findings |
| Full Git history and working-tree secret scan | No findings after reviewed false-positive suppressions |
| Peer dependency consistency | Pass |
| Core/server/adapter STRIDE review | No unresolved exploitable finding identified internally |
| Selected C2SP/Wycheproof vectors | AES-256-GCM, X25519, and HKDF-SHA-256 pass |
| Semgrep OWASP/application/workflow scan | No findings after remediation |
| Automated browser accessibility | Pass across configured Chromium, Firefox, WebKit, and mobile Chromium matrix |
| Incognito-like storage disposal | Pass |
| 6× CPU-throttled Recovery Kit flow | Pass |
| Simulated laptop-suspension idle lock | Pass |
| Current verified suites | 130 unit/integration, 3 real-PostgreSQL adapter, 1 scale, and 25 browser tests pass |
The final release refresh scanned 114 commits with Gitleaks and 432 tracked files with Semgrep.
Gitleaks, Semgrep, Trivy including development dependencies, and pnpm audit reported zero
findings. The canonical documentation target is https://ownfold.dipxsy.app/docs; DNS and hosting
must be activated before it is described as publicly available.
All 20 corrected package versions are published under the npm beta dist-tag. A clean temporary
consumer installed the exact registry versions, type-checked every supported package root and
subpath, and imported them at runtime. Default latest tags and superseded first-publish versions
still require registry-owner normalization.
The detailed internal artifacts live under artifacts/ in the repository. They are intentionally
called internal: the same authors and automated agents that changed the code cannot provide an
independent security opinion.
Still required for a production-grade beta
An independent cryptographic/application-security assessment, VoiceOver/Safari and NVDA sign-off, physical low-powered devices, native private modes, real storage-pressure/background tests, npm provenance and registry normalization, and a canonical deployed documentation URL remain open. See the production-beta evidence record for the exact acceptance matrix.
Public npm packages and trusted publishing can use npm’s free plan. Public provenance still requires a public source repository; the locally published developer beta therefore has no provenance statement.