security-reviewlisted

Comprehensively re-analyze Hot Sheet's **attack surface** and produce a dated, severity-ranked security report. This is the standing "revisit the security analysis on every release" mechanism (HS-8987). Hot Sheet is a high-value target: it runs shell commands + terminals (RCE-equivalent authority), holds plugin OAuth tokens + keychain secrets, and — with `--bind` / the §46 remote epic — can be reachable off-box. Treat it accordingly. **Two non-negotiables that make this skill worth running:** 1. **Enumerate the surface from the CODE, not this list.** The list below is a starting map; the real surface is whatever the current code exposes. Re-derive it every run — new routes, new WS endpoints, new MCP tools, new plugins appear between releases. 2. **Do PROACTIVE external research every run.** Do not rely only on training knowledge — fetch the latest advisories/CVEs for the actual dependency versions and recent attack-pattern writeups. ## Step 1 — Re-derive the attack surface from the code Don't trust the map below; regenerate it. Useful sweeps (adjust as the code moves): - **HTTP routes:** `Grep` for `.get(` / `.post(` / `.patch(` / `.put(` / `.delete(` / `.use(` and `app.route(` across `src/routes/**` and `src/server.ts`. List every path + method. - **WebSocket endpoints:** `src/terminals/websocket.ts` (`/api/terminal/ws`), `src/routes/wsSync.ts` (`/ws/sync`) — and any new `httpServer.on('upgrade')` handlers. - **OTLP ingest:** `src/routes/otel.ts` (`/v1/metri