docs: update SECURITY.md scope and container hardening

[aliasunder]

Summary

• Split the Scope section into Server attack surface (what ships in the Docker image) and Reference deployment (the maintainer's IaC — API Gateway, Lambda, Lightsail, CI/CD). Adopters bring their own TLS termination, reverse proxy, and hosting — those aren't part of vault-cortex itself.
• Fixed stale container hardening details:
  • "two containers sharing a volume" → single container with s6-overlay (:remote target)
  • PID 1 init now documents both targets (tini for :local, s6's /init for :remote)
  • Base image corrected from node:24-slim to node:24-trixie-slim
  • Non-root user documents both user names (node on :local, obsidian on :remote)
  • Removed Compose-specific log rotation (deployer concern, not image hardening)
  • Added daily layer-cache bust note for Debian security patches

Test plan

• Verify the Scope section reads correctly for both vault-cortex adopters and security researchers
• Confirm container hardening details match the current Dockerfile

🤖 Generated with Claude Code

[umm-actually]

Update stale '$5/mo for Obsidian Sync' cost claim in README
Medium severity · correctness · high confidence

README.md:18 — beyond the diff's line ranges, in code the changes touch or depend on.

The README's Deployment Options section states '$5/mo for Obsidian Sync'. The official Obsidian Sync pricing is now $10/mo (raised in late 2025). The ARCHITECTURE.md Cost section correctly states '$5/mo' but both docs are stale — the actual cost is $10/mo.

Failure scenario: A user budgets $5/mo for Obsidian Sync based on the README, then discovers the actual cost is $10/mo when signing up. The documentation is misleading about the total cost of a remote deployment.

Suggested fix

Update '$5/mo' to '$10/mo' in the README's Deployment Options cost line, or link to Obsidian's current pricing page instead of quoting a fixed number.

[umm-actually]

Update stale 'non-root user' claim in README Data Integrity section
Medium severity · correctness · high confidence

README.md:315 — beyond the diff's line ranges, in code the changes touch or depend on.

The README says 'non-root user' without distinguishing the two targets. SECURITY.md now correctly documents node on :local and obsidian on :remote. The README's claim is ambiguous and could mislead readers who assume a single user name across both targets.

Failure scenario: A reader checking the README for the non-root user name tries to use 'node' on the remote target and finds the user doesn't exist, or vice versa. The ambiguity creates confusion between the two targets.

Suggested fix

Change 'non-root user' to 'non-root user (`node` on `:local`, `obsidian` on `:remote`, both UID 1000)' to match the SECURITY.md precision.

[umm-actually]

Update stale 'PID 1 init (tini)' claim in README Data Integrity section
Medium severity · correctness · high confidence

README.md:316 — beyond the diff's line ranges, in code the changes touch or depend on.

The README's Data Integrity section states 'PID 1 init (tini)' as the single init mechanism. The remote target uses s6-overlay's /init, not tini — this was corrected in SECURITY.md but the README still carries the old claim.

Failure scenario: A reader of the README's Data Integrity section learns that the container uses tini as PID 1 init, then reads SECURITY.md and sees conflicting information about s6-overlay on the remote target. The README's claim is factually wrong for the remote image — which is the production target.

Suggested fix

Change 'PID 1 init (`tini`)' to 'PID 1 init (`tini` on `:local`, s6-overlay's `/init` on `:remote`)' to match the updated SECURITY.md hardening list.

[umm-actually]

umm-actually re-reviewed at 8adcaec

1 new finding(s) posted (3 tracked finding(s) across all runs).

---

umm-actually · deepseek/deepseek-v4-pro

[aliasunder]

Addressing the 3 umm-actually PR-level findings:

1. Obsidian Sync pricing ($5/mo claim) — False positive. The bot claims the price is $10/mo; the actual current price is $4 USD/mo billed annually (verified against the Obsidian pricing page by the maintainer). This PR corrects the stale $5/mo to $4 USD/mo across all docs.

2. Non-root user specificity in README — Intentional. The Data Integrity section is a scannable summary linking to SECURITY.md for full detail ("See SECURITY.md → Runtime Hardening for the full attack-surface inventory"). Adding per-target user names to a one-line summary bullet is over-specification — the same bullet says "PID 1 init" without per-target detail, at the same level of summarization.

3. PID 1 init (tini) in README — Already fixed. Commit 8adcaec removed the (tini) qualifier from the README Data Integrity summary. The finding references a pre-fix state.

---

🔍 ship-check · pr-monitor · claude-opus-4-6[1m]