[pitimon]

Adds a Security audit section to the README (after Privacy) with the scan infographic, plus the full report under docs/.

• Audit date: 18 October 2026, at commit 33c87e5
• Methodology adapted from Anthropic's OSS Scanner: threat model → sink-driven code review → dynamic round (live DNS-rebinding/CORS probes, parser fuzzing, HTML data-flow review)
• Result: 0 confirmed vulnerabilities; 9 defensive controls verified, 3/3 deep probes closed
• Files: docs/security-scan-20261018.svg (infographic), docs/security-scan-20261018.md (full report, Thai), README section linking both

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T01:12:46.213719Z	d1c127a	PR opened
🔒 Security Review	✅ Completed 2026-10-18T01:12:52.019482Z	d1c127a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d1c127a5ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Align the stated scope with the dynamic audit

The scope says this was not a fuzzing or live-attack exercise, but the preceding methodology and the rest of the report explicitly claim live server probes and parser fuzzing, including measured results. This contradiction makes the audit scope unclear and undermines the README's security claim; update this sentence to describe the dynamic testing that was actually performed.

Useful? React with 👍 / 👎.