docs(security): 2026-07-31 post-audit diff review — no new findings

[jeduden]

Summary

Scheduled weekly post-audit security diff review, covering everything merged since the 2026-07-24 review (base d4af5d5 → HEAD 2ab4b29, 98 files). Adds the review artifacts under docs/security/2026-07-31-post-audit-diff-review/ (findings.json / report.md / findings.sarif / inline-annotations.json) and regenerates the SECURITY.md catalog.

Verdict: no new security findings. report.md records 0 across all severities.

What the window contained

• Overwhelmingly semantic-preserving perf refactoring (struct-field reordering, byte-scan gating, memoization), test additions, and doc/merge-driver correctness fixes.
• Two content-only rules: MDS060 occurrence (compiles config-supplied patterns with Go RE2 — linear-time, no ReDoS; no exec/network/path sink) and MDS073 slidev-structure follow-up (rule already reviewed 2026-07-24).

§0 baseline reconfirmed

• No new exec/network/spawn sink anywhere in the diff — the only grep hits are the prose of last week's own MDS072 report. Recipes still not executed by the tool.
• Every filesystem/path sink added in the diff is in _test.go files, except a githooks refactor that resolves an unchanged git rev-parse hooks dir once instead of twice (no path/symlink semantics changed).
• The include directive, goldmark parser, foreignregion scan, and crossfile glob-validation changes are all semantic-preserving perf refactors (verified equivalence in the report).

Net security hardening this window

• internal/corpus/collect.go: caps read size and closes a Stat→read TOCTOU, skipping oversized/racy files instead of aborting the corpus build.
• internal/lint/file.go ColumnOfOffset: adds a negative-offset clamp and switches to the cached newline binary search.

Carried over (out of scope this window)

The MDS072 external-link-check SSRF finding (S001 of 2026-07-24) remains open — internal/rules/externallink/ was untouched, and its fix plan plan/2607242010_mds072-ssrf-network-hardening.md is still open. Not re-filed here to avoid duplicate tracking. No new plans were filed because there were no new actionable findings.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UTLab5Xq2pxqWDVqP9rbSq

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.71%. Comparing base (2ab4b29) to head (9e7374c).

Additional details and impacted files

Components	Coverage Δ
Go	98.70% <ø> (ø)
TypeScript	99.54% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.