[variablenix]

Confirmed findings fixed

• Bind owner authorization to network/account: legacy bare names retain primary-network access only; explicit network/account entries grant other networks. Same-named secondary-network accounts no longer inherit owner privileges.
• Require authenticated private-message note access and scope new records by network/account. Keep legacy notes untouched in their original bucket, without automatic ownership claims; new records use notes_v2. Reset disabled expiry correctly when reinitializing.
• Share strict public-address validation across website status, URL previews, paste sources, and Ask excerpts. Block shared/CGNAT, reserved, benchmark, documentation, transition, and local addresses; reject mixed private/public DNS answers.
• Disable proxy bypasses, bound redirects/headers, cap URL-preview workers across networks, snapshot settings across reloads, and omit URL paths/queries from slow-fetch logs.
• Bound command/warning histories; honor cancellation and a 15-second IRC connection limit; count failed writes as dropped rather than sent.
• Reject one-sided excerpts for explicit comparison questions, so irrelevant fast fallbacks cannot beat complete Assist answers. Retain a complete snippet when an origin refresh loses context; generated Assist paraphrases are unchanged.
• Sanitize external title/channel/duration fields at formatting boundaries; add regressions and update guides.

Audit scope and verification

• Reviewed dispatch/authorization, private-account isolation, arbitrary-URL fetching, TLS/authentication, IRC output, local-file inputs, BoltDB persistence, background work, and rate-limit state.
• Gosec v2.30.0 initially scanned 86 source files (about 22,000 lines), with no analysis errors. All 82 initial warnings were reviewed; 81 contextual warnings remain after the failed-write fix: non-security random content/game selection, operator-configured files, explicit legacy checksum commands, configured TLS-verification opt-out, and best-effort cleanup/protocol writes. They are not 81 confirmed vulnerabilities; no blanket suppressions were added.
• Full race suite including offline Chrome fixtures, vet, staticcheck, module verification, Linux build, and govulncheck passed on final head b4889dd. No known reachable dependency vulnerabilities were reported.
• Gitleaks v8.30.1 found no secrets in a clean export of the final tracked snapshot; private ignored environment files are excluded from this public-source result.
• All 21 provider-plugin checks (including dictionary fallback), both YouTube searches, four screenshot status cases, and three Ask relevance baselines passed live before and after deployment, without IRC messages. An earlier one-sided comparison failure was diagnosed and fixed, not merely retried away.
• Final PR and main-branch Verify/CodeQL checks passed; GitHub reported no open code-scanning alerts. All prerequisite PRs chore(deps): bump github.com/agnivade/levenshtein from 1.2.1 to 1.2.2 #178–Honor website targets for status, ping, and uptime #181 are merged.
• Authentication uses the accepted IRCv3 account-tag specification; server account tags are distinct from untrusted client-only tags under the message-tags specification.

Intentional compatibility changes

• Notes require authenticated private messages. Legacy records remain stored and unclaimed; offline recovery requires verified ownership.
• Bare owner entries retain first-network access. Use network/account entries for additional network grants.
• Keep verify_cert: true. Verification bypass remains an unsafe trusted-operator option, not a command capability; both deployment networks verify certificates.

Deployed

• Rebuilt b4889dd with Go 1.26.10 and restarted the service; verified the running executable revision and clean build metadata.
• Both networks and four configured channels are connected. Post-restart live checks passed; metrics reported zero plugin panics and dropped messages.
• Configuration contents, credentials, certificates, and data were preserved. The configuration file is now owner-only (mode 600); credential/certificate files already had restrictive permissions.
• Passing tests/scanners are not proof of zero defects or future upstream availability.

Final source-wide Gosec rerun covered 88 production Go files (22,254 lines), reported no analysis errors, and retained the same 81 reviewed contextual warnings. Final source govulncheck remained clear. Temporary task checkouts/snapshots were removed after post-restart verification; original configuration and data remain intact.