UEDF Sentinel v5.0 is currently in pre-production hardening. A structural security audit was completed on 2026-05-21 — see SECURITY-AUDIT-2026-05-21.md for the full report.

This system MUST NOT be deployed to production until all Critical and High findings are resolved.

Only main is supported. The develop branch may contain unreviewed work.

From the 2026-05-21 audit:

Each finding has reproduction, risk, and remediation in the audit document.

If you find a security issue:

1. Do not open a public issue.
2. Use GitHub's private security advisory or contact via the profile.
3. Include: affected version/commit, reproduction steps, impact assessment.

Expected response: 72 hours to acknowledge, 14 days for initial assessment. Critical findings get a same-week patch path.

In order:

1. Remove hardcoded credentials (findings 1, 2, 3) — blocks all deployments.
2. CORS allowlist + security headers (findings 4, 8) — required before any browser-accessible endpoint goes live.
3. Session regeneration + brute-force enforcement (findings 6, 9) — required before opening login to non-VPN clients.
4. Raw-query elimination (finding 5) — CI gate added to prevent regression.
5. display_errors=0 in production (finding 7) — config flag.

• npm audit runs in CI on every push (server/ WebSocket shim).
• Dependabot is enabled for npm, composer, and github-actions with weekly cadence.
• PHP composer dependencies (when added) will gate on composer audit.

This is command and control software for a real defense force. The threat model assumes:

• Network-resident adversaries (nation-state and criminal).
• Insider risk (privileged user misuse).
• Supply-chain risk on every dependency added.

The audit document captures the structural baseline; runtime hardening (SIEM integration, anomaly detection, audit log review cadence) is a separate workstream.

Five files committed at the initial scaffolding (b79e421) carried corrupted content — literal ECHO is on. injection from a Windows shell capture, truncated $this-> references, broken = assignments — and declared a Sentinel\ namespace that was never wired into composer.json's PSR-4 autoload (UEDF\\ → src/). A repo-wide search confirmed zero callers. They were removed entirely in the May 2026 CI honesty pass:

• src/Security/CSRF.php
• src/health.php
• src/Auth/Authentication.php
• src/WebSocket/Server.php
• src/Collaboration/TeamManager.php

If real implementations are needed later, use the existing UEDF\\ namespace and follow the working neighbours (src/Auth/Session.php, src/Auth/TokenAuth.php, src/WebSocket/RealTimeServer.php).