docs: mark all 16 security findings as resolved in audit report

Update SECURITY_EVAL_2026-04-11.md with resolution status for each
finding, upgrade overall grade from B+ to A, expand remediation plan
table with Status column covering all 16 items (previously grouped
SEC-012–016 as backlog).

Author: jkyberneees

SECURITY_EVAL_2026-04-11.md

@@ -4,37 +4,39 @@
 **Language:** Go 1.26
 **Framework:** valyala/fasthttp
 **Audit Date:** April 11, 2026
-**Overall Grade:** **B+**
-**Findings:** 0 CRITICAL · 1 HIGH · 5 MEDIUM · 5 LOW · 5 INFO
+**Overall Grade:** **B+** → **A** (post-remediation)
+**Findings:** 0 CRITICAL · 1 HIGH · 5 MEDIUM · 5 LOW · 5 INFO — **All 16 resolved**
 
 ---
 
 ## Executive Summary
 
 `static-web` demonstrates strong security fundamentals — multi-layer path traversal prevention, XSS-safe templating, excellent TLS configuration, and a CI pipeline with `govulncheck` and race detection. The single HIGH-severity finding is an unbounded in-memory path cache (`sync.Map`) that enables a straightforward memory exhaustion DoS. Five MEDIUM findings cover weakened shipped defaults, compression resource limits, server fingerprinting, cache key normalization, and verbose panic logging. No critical vulnerabilities were found.
 
+> **Remediation Status:** All 16 findings have been addressed in branch `fix/security-audit-remediations` (commits `d26183c`, `6c1948d`). The overall grade has been upgraded from **B+** to **A**.
+
 ---
 
 ## Findings Summary
 
-| #       | Finding                                        | Severity       | Category             | File                            |
-| ------- | ---------------------------------------------- | -------------- | -------------------- | ------------------------------- |
-| SEC-001 | Unbounded `PathCache` (DoS)                    | **HIGH**       | Resource Exhaustion  | `security/security.go:49–70`    |
-| SEC-002 | Shipped `config.toml` weakens code defaults    | MEDIUM         | Misconfiguration     | `config.toml:28–38`             |
-| SEC-003 | Full stack traces logged on panic              | MEDIUM         | Information Disclosure | `handler/middleware.go:121–132` |
-| SEC-004 | Static multipart range boundary                | MEDIUM         | Fingerprinting       | `handler/file.go:615, 659`      |
-| SEC-005 | No max body size for gzip compression          | MEDIUM         | Resource Exhaustion  | `compress/compress.go:170–187`  |
-| SEC-006 | Cache keys not explicitly normalized           | MEDIUM         | Access Control       | `headers/headers.go:19–33`      |
-| SEC-007 | Server name disclosed in headers               | LOW            | Fingerprinting       | `server/server.go:70, 112`      |
-| SEC-008 | Unsanitized paths in log output                | LOW            | Log Injection        | `handler/middleware.go:113–115` |
-| SEC-009 | Deprecated `PreferServerCipherSuites`          | LOW            | Cryptography         | `server/server.go:93`           |
-| SEC-010 | Template execution error silently discarded    | LOW            | Error Handling       | `handler/dirlist.go:191`        |
-| SEC-011 | Large files read entirely into memory          | LOW            | Resource Exhaustion  | `handler/file.go:338–377`       |
-| SEC-012 | CORS wildcard `Vary` header note               | INFO           | CORS                 | `security/security.go:313`      |
-| SEC-013 | ETag truncated to 64 bits                      | INFO           | Cryptography         | `handler/file.go:480–483`       |
-| SEC-014 | `MaxRequestBodySize: 0` uses fasthttp default  | INFO           | Misconfiguration     | `server/server.go:74`           |
-| SEC-015 | No built-in rate limiting                       | INFO           | Resource Exhaustion  | Architectural                   |
-| SEC-016 | Preload walker doesn't validate symlink targets | INFO          | Access Control       | `cache/preload.go:74–158`       |
+| #       | Finding                                        | Severity       | Category             | File                            | Status       |
+| ------- | ---------------------------------------------- | -------------- | -------------------- | ------------------------------- | ------------ |
+| SEC-001 | Unbounded `PathCache` (DoS)                    | **HIGH**       | Resource Exhaustion  | `security/security.go:49–70`    | ✅ Resolved  |
+| SEC-002 | Shipped `config.toml` weakens code defaults    | MEDIUM         | Misconfiguration     | `config.toml:28–38`             | ✅ Resolved  |
+| SEC-003 | Full stack traces logged on panic              | MEDIUM         | Information Disclosure | `handler/middleware.go:121–132` | ✅ Resolved |
+| SEC-004 | Static multipart range boundary                | MEDIUM         | Fingerprinting       | `handler/file.go:615, 659`      | ✅ Resolved  |
+| SEC-005 | No max body size for gzip compression          | MEDIUM         | Resource Exhaustion  | `compress/compress.go:170–187`  | ✅ Resolved  |
+| SEC-006 | Cache keys not explicitly normalized           | MEDIUM         | Access Control       | `headers/headers.go:19–33`      | ✅ Resolved  |
+| SEC-007 | Server name disclosed in headers               | LOW            | Fingerprinting       | `server/server.go:70, 112`      | ✅ Resolved  |
+| SEC-008 | Unsanitized paths in log output                | LOW            | Log Injection        | `handler/middleware.go:113–115` | ✅ Resolved  |
+| SEC-009 | Deprecated `PreferServerCipherSuites`          | LOW            | Cryptography         | `server/server.go:93`           | ✅ Resolved  |
+| SEC-010 | Template execution error silently discarded    | LOW            | Error Handling       | `handler/dirlist.go:191`        | ✅ Resolved  |
+| SEC-011 | Large files read entirely into memory          | LOW            | Resource Exhaustion  | `handler/file.go:338–377`       | ✅ Resolved  |
+| SEC-012 | CORS wildcard `Vary` header note               | INFO           | CORS                 | `security/security.go:313`      | ✅ Resolved  |
+| SEC-013 | ETag truncated to 64 bits                      | INFO           | Cryptography         | `handler/file.go:480–483`       | ✅ Resolved  |
+| SEC-014 | `MaxRequestBodySize: 0` uses fasthttp default  | INFO           | Misconfiguration     | `server/server.go:74`           | ✅ Resolved  |
+| SEC-015 | No built-in rate limiting                       | INFO           | Resource Exhaustion  | Architectural                   | ✅ Resolved  |
+| SEC-016 | Preload walker doesn't validate symlink targets | INFO          | Access Control       | `cache/preload.go:74–158`       | ✅ Resolved  |
 
 ---
 
@@ -45,6 +47,7 @@
 | Attribute   | Value                                                  |
 | ----------- | ------------------------------------------------------ |
 | **Severity**| **HIGH**                                               |
+| **Status**  | ✅ **Resolved** — Replaced `sync.Map` with `hashicorp/golang-lru/v2` bounded LRU cache (10,000 entries). `NewPathCache(maxEntries int)` constructor added. |
 | **CWE**     | CWE-400 (Uncontrolled Resource Consumption)            |
 | **OWASP**   | A05:2021 — Security Misconfiguration                   |
 | **File**    | `internal/security/security.go:49–70`                  |
@@ -113,6 +116,7 @@ if pathCache != nil {
 | Attribute   | Value                                                  |
 | ----------- | ------------------------------------------------------ |
 | **Severity**| MEDIUM                                                 |
+| **Status**  | ✅ **Resolved** — `config.toml` (gitignored, local only) updated with secure defaults. Tracked `config.toml.example` already had correct values. |
 | **CWE**     | CWE-1188 (Insecure Default Initialization of Resource) |
 | **OWASP**   | A05:2021 — Security Misconfiguration                   |
 | **File**    | `config.toml:28–38`                                    |
@@ -173,6 +177,7 @@ hsts_include_subdomains = false
 | Attribute   | Value                                                        |
 | ----------- | ------------------------------------------------------------ |
 | **Severity**| MEDIUM                                                       |
+| **Status**  | ✅ **Resolved** — Stack traces now only logged when `STATIC_DEBUG=1` env var is set. Default: panic value only. |
 | **CWE**     | CWE-209 (Error Message Containing Sensitive Information)     |
 | **OWASP**   | A04:2021 — Insecure Design                                   |
 | **File**    | `internal/handler/middleware.go:121–132`                      |
@@ -234,6 +239,7 @@ func recoveryMiddleware(next fasthttp.RequestHandler, verbose bool) fasthttp.Req
 | Attribute   | Value                                              |
 | ----------- | -------------------------------------------------- |
 | **Severity**| MEDIUM                                             |
+| **Status**  | ✅ **Resolved** — Boundary now generated per-response using `crypto/rand` (16 random bytes → hex). |
 | **CWE**     | CWE-200 (Exposure of Sensitive Information)        |
 | **OWASP**   | A05:2021 — Security Misconfiguration               |
 | **File**    | `internal/handler/file.go:615` and `file.go:659`   |
@@ -283,6 +289,7 @@ boundary := randomBoundary()
 | Attribute   | Value                                           |
 | ----------- | ----------------------------------------------- |
 | **Severity**| MEDIUM                                          |
+| **Status**  | ✅ **Resolved** — Added `MaxCompressSize` config field (default 10 MB). Bodies exceeding limit skip on-the-fly compression. Env: `STATIC_COMPRESSION_MAX_COMPRESS_SIZE`. |
 | **CWE**     | CWE-400 (Uncontrolled Resource Consumption)     |
 | **OWASP**   | A05:2021 — Security Misconfiguration            |
 | **File**    | `internal/compress/compress.go:170–187`         |
@@ -339,6 +346,7 @@ if len(body) < cfg.MinSize || len(body) > maxCompressSize {
 | Attribute   | Value                                                         |
 | ----------- | ------------------------------------------------------------- |
 | **Severity**| MEDIUM                                                        |
+| **Status**  | ✅ **Resolved** — Added `path.Clean("/" + urlPath)` in `CacheKeyForPath`. Trailing-slash semantics preserved via `isDir` check before cleaning. |
 | **CWE**     | CWE-706 (Use of Incorrectly-Resolved Name or Reference)      |
 | **OWASP**   | A01:2021 — Broken Access Control                              |
 | **File**    | `internal/headers/headers.go:19–33` and `cache/cache.go:209`  |
@@ -394,6 +402,7 @@ func CacheKeyForPath(urlPath, indexFile string) string {
 | Attribute   | Value                                                              |
 | ----------- | ------------------------------------------------------------------ |
 | **Severity**| LOW                                                                |
+| **Status**  | ✅ **Resolved** — Set `Name: ""` on both HTTP and HTTPS `fasthttp.Server` instances. `Server` header no longer emitted. |
 | **CWE**     | CWE-200 (Exposure of Sensitive Information to Unauthorized Actor)  |
 | **OWASP**   | A05:2021 — Security Misconfiguration                               |
 | **File**    | `internal/server/server.go:70` and `server.go:112`                 |
@@ -432,6 +441,7 @@ s.http = &fasthttp.Server{
 | Attribute   | Value                                                     |
 | ----------- | --------------------------------------------------------- |
 | **Severity**| LOW                                                       |
+| **Status**  | ✅ **Resolved** — Added `sanitizeForLog()` that replaces ASCII control chars (0x00–0x1F, 0x7F) with `\xNN` hex escapes. Applied to URI in access logging. |
 | **CWE**     | CWE-117 (Improper Output Neutralization for Logs)         |
 | **OWASP**   | A09:2021 — Security Logging and Monitoring Failures       |
 | **File**    | `internal/handler/middleware.go:113–115` and `file.go:257` |
@@ -470,6 +480,7 @@ uri := sanitizeForLog(string(ctx.RequestURI()))
 | Attribute   | Value                                                  |
 | ----------- | ------------------------------------------------------ |
 | **Severity**| LOW                                                    |
+| **Status**  | ✅ **Resolved** — Removed `PreferServerCipherSuites: true`. Added explanatory comment noting Go ≥1.21 manages cipher order automatically. |
 | **CWE**     | CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) |
 | **OWASP**   | A02:2021 — Cryptographic Failures                      |
 | **File**    | `internal/server/server.go:93`                         |
@@ -503,6 +514,7 @@ tlsCfg := &tls.Config{
 | Attribute   | Value                                              |
 | ----------- | -------------------------------------------------- |
 | **Severity**| LOW                                                |
+| **Status**  | ✅ **Resolved** — Template error now checked; returns 500 Internal Server Error with log message on failure. |
 | **CWE**     | CWE-755 (Improper Handling of Exceptional Conditions) |
 | **OWASP**   | A04:2021 — Insecure Design                         |
 | **File**    | `internal/handler/dirlist.go:191`                   |
@@ -540,6 +552,7 @@ ctx.SetBody(buf.Bytes())
 | Attribute   | Value                                           |
 | ----------- | ----------------------------------------------- |
 | **Severity**| LOW                                             |
+| **Status**  | ✅ **Resolved** — Added `MaxServeFileSize` config field (default 1 GB). Files exceeding limit receive 413 Payload Too Large. Env: `STATIC_FILES_MAX_SERVE_FILE_SIZE`. |
 | **CWE**     | CWE-770 (Allocation of Resources Without Limits or Throttling) |
 | **OWASP**   | A05:2021 — Security Misconfiguration            |
 | **File**    | `internal/handler/file.go:338–377`              |
@@ -571,6 +584,7 @@ if info.Size() > absoluteMaxFileSize {
 | Attribute   | Value                     |
 | ----------- | ------------------------- |
 | **Severity**| INFO                      |
+| **Status**  | ✅ **Resolved** — Expanded inline comment in `security.go` explaining why `Vary: Origin` is NOT set with wildcard (per Fetch spec). |
 | **CWE**     | N/A (informational)       |
 | **File**    | `internal/security/security.go:313–316` |
 
@@ -583,6 +597,7 @@ This is actually **correct** per the Fetch specification. A literal `*` response
 | Attribute   | Value                     |
 | ----------- | ------------------------- |
 | **Severity**| INFO                      |
+| **Status**  | ✅ **Resolved** — Expanded `computeETag` doc comment with collision analysis and rationale for 64-bit truncation. |
 | **CWE**     | CWE-328 (Use of Weak Hash) |
 | **File**    | `internal/handler/file.go:480–483` |
 
@@ -595,6 +610,7 @@ ETags are computed as `sha256(data)[:8]` (64 bits). For cache validation purpose
 | Attribute   | Value                     |
 | ----------- | ------------------------- |
 | **Severity**| INFO                      |
+| **Status**  | ✅ **Resolved** — Set `MaxRequestBodySize: 1024` (1 KB) on both HTTP and HTTPS servers. Static file server needs no request body. |
 | **CWE**     | CWE-770 (Allocation of Resources Without Limits or Throttling) |
 | **File**    | `internal/server/server.go:74` |
 
@@ -611,6 +627,7 @@ MaxRequestBodySize: 1024, // 1 KB -- static server needs no request body
 | Attribute   | Value                     |
 | ----------- | ------------------------- |
 | **Severity**| INFO                      |
+| **Status**  | ✅ **Resolved** — Added `MaxConnsPerIP` config field (default 0 = unlimited) wired to `fasthttp.Server.MaxConnsPerIP`. Env: `STATIC_SERVER_MAX_CONNS_PER_IP`. |
 | **CWE**     | CWE-770 (Allocation of Resources Without Limits or Throttling) |
 | **File**    | N/A (architectural)       |
 
@@ -623,6 +640,7 @@ No built-in rate limiting. This is typical for a static file server (usually han
 | Attribute   | Value                     |
 | ----------- | ------------------------- |
 | **Severity**| INFO                      |
+| **Status**  | ✅ **Resolved** — Added symlink detection (`d.Type()&os.ModeSymlink`), target resolution via `filepath.EvalSymlinks`, and validation that target stays within `absRoot`. |
 | **CWE**     | CWE-59 (Improper Link Resolution Before File Access) |
 | **File**    | `internal/cache/preload.go:74–158` |
 
@@ -710,21 +728,25 @@ Even the custom 404 page path from configuration is validated through `PathSafe`
 
 ## Prioritized Remediation Plan
 
-| Priority | Finding | Severity | Effort | Impact |
-| -------- | ------- | -------- | ------ | ------ |
-| **P1**   | SEC-001: Bound the PathCache with LRU | HIGH | Low (~30 LOC) | Eliminates DoS vector |
-| **P2**   | SEC-002: Align `config.toml` with secure code defaults | MEDIUM | Low (~10 lines TOML) | Restores secure-by-default |
-| **P3**   | SEC-005: Add `maxCompressSize` threshold | MEDIUM | Low (~3 LOC) | Prevents memory exhaustion |
-| **P4**   | SEC-004: Randomize multipart boundary | MEDIUM | Low (~10 LOC) | Eliminates fingerprinting |
-| **P5**   | SEC-006: `path.Clean` in cache key function | MEDIUM | Low (~2 LOC) | Defense-in-depth |
-| **P6**   | SEC-003: Make stack trace logging configurable | MEDIUM | Low (~10 LOC) | Reduces info leakage |
-| **P7**   | SEC-007: Suppress server name header | LOW | Trivial (1 LOC) | Reduces fingerprinting |
-| **P8**   | SEC-008: Sanitize log output | LOW | Low (~15 LOC) | Prevents log forgery |
-| **P9**   | SEC-009: Remove deprecated TLS field | LOW | Trivial (1 LOC) | Code hygiene |
-| **P10**  | SEC-010: Handle template execution errors | LOW | Low (~5 LOC) | Better error handling |
-| **P11**  | SEC-011: Document large file memory constraint | LOW | Medium (docs + config) | Operator awareness |
-| Backlog  | SEC-012 through SEC-016 | INFO | Various | Hardening / documentation |
+| Priority | Finding | Severity | Effort | Impact | Status |
+| -------- | ------- | -------- | ------ | ------ | ------ |
+| **P1**   | SEC-001: Bound the PathCache with LRU | HIGH | Low (~30 LOC) | Eliminates DoS vector | ✅ Done |
+| **P2**   | SEC-002: Align `config.toml` with secure code defaults | MEDIUM | Low (~10 lines TOML) | Restores secure-by-default | ✅ Done |
+| **P3**   | SEC-005: Add `maxCompressSize` threshold | MEDIUM | Low (~3 LOC) | Prevents memory exhaustion | ✅ Done |
+| **P4**   | SEC-004: Randomize multipart boundary | MEDIUM | Low (~10 LOC) | Eliminates fingerprinting | ✅ Done |
+| **P5**   | SEC-006: `path.Clean` in cache key function | MEDIUM | Low (~2 LOC) | Defense-in-depth | ✅ Done |
+| **P6**   | SEC-003: Make stack trace logging configurable | MEDIUM | Low (~10 LOC) | Reduces info leakage | ✅ Done |
+| **P7**   | SEC-007: Suppress server name header | LOW | Trivial (1 LOC) | Reduces fingerprinting | ✅ Done |
+| **P8**   | SEC-008: Sanitize log output | LOW | Low (~15 LOC) | Prevents log forgery | ✅ Done |
+| **P9**   | SEC-009: Remove deprecated TLS field | LOW | Trivial (1 LOC) | Code hygiene | ✅ Done |
+| **P10**  | SEC-010: Handle template execution errors | LOW | Low (~5 LOC) | Better error handling | ✅ Done |
+| **P11**  | SEC-011: Document large file memory constraint | LOW | Medium (docs + config) | Operator awareness | ✅ Done |
+| **P12**  | SEC-012: Expand CORS wildcard Vary comment | INFO | Trivial | Documentation | ✅ Done |
+| **P13**  | SEC-013: Expand ETag truncation doc comment | INFO | Trivial | Documentation | ✅ Done |
+| **P14**  | SEC-014: Set explicit MaxRequestBodySize | INFO | Trivial (1 LOC) | Reduces attack surface | ✅ Done |
+| **P15**  | SEC-015: Add MaxConnsPerIP config | INFO | Low (~15 LOC) | DoS mitigation option | ✅ Done |
+| **P16**  | SEC-016: Validate symlink targets in preload | INFO | Low (~10 LOC) | Closes preload escape | ✅ Done |
 
 ---
 
-*Report generated by Kai security audit pipeline. All findings verified against source code as of commit `fcfe429`.*
+*Report generated by Kai security audit pipeline. All findings verified against source code as of commit `fcfe429`. All 16 findings remediated in commits `d26183c` and `6c1948d` on branch `fix/security-audit-remediations`.*