Add security.md: comprehensive security risk assessment

[fabricekabongo]

Motivation

• Provide a centralized, codebase-specific security review to guide hardening and prioritize fixes.
• Surface risks across network, cluster, admin UI, and data-plane protocols including OWASP Top 10 categories.
• Highlight low-level/runtime concerns (panic/recursion), Go/HTML-specific attack vectors, and business-logic / financial-DoS abuse paths.
• Offer a prioritized remediation roadmap (P0/P1/P2) and quick threat-model summary.

Description

• Add a new top-level security.md file containing a structured security risk assessment that maps findings to the OWASP Top 10 and details mitigations.
• Include analysis of complex memory/runtime risks (use-after-free context, recursion/stack exhaustion, panic-driven DoS) and operational availability risks (Slowloris, query amplification, cluster churn).
• Document Go- and HTML/JS-specific issues (connection handling, namespace cardinality, DOM XSS in the admin UI) and business-logic abuse cases (unauthenticated deletes, cluster poisoning).
• Provide prioritized remediation recommendations (immediate P0 fixes like authN/authZ and mTLS, near-term P1, and medium-term P2 work) plus a short threat-model summary.

Testing

• Ran the Go test suite with go test ./... and all packages reported success.
• The change only adds security.md and does not modify runtime code paths, and automated tests passed (ok for packages exercised).

---

Codex Task

[deepsource-io]

DeepSource Code Review

We reviewed changes in ece3789...ad44eed on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene   Coverage

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Docker		Apr 9, 2026 8:23p.m.	Review ↗
Secrets		Apr 9, 2026 8:23p.m.	Review ↗
Test coverage		Apr 9, 2026 8:23p.m.	Review ↗
Go		Apr 9, 2026 8:23p.m.	Review ↗

Code Coverage Summary

Language	Line Coverage (Overall)
Aggregate	68%
Go	68%

➟ Additional coverage metrics may have been reported. See full coverage report ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.