docs: sync documentation with current implementation and archive stale plan

SECURITY_AUDIT.md

@@ -0,0 +1,58 @@
+# LLM Proxy Security Audit Report
+
+## Executive Summary
+A comprehensive security audit of the `llm-proxy` repository was conducted. The audit identified **1 critical vulnerability**, **3 high-risk issues**, **4 medium-risk issues**, and **3 low-risk issues**. The most severe findings include Cross-Site Scripting (XSS) in the dashboard interface and insecure storage of provider API keys in the database.
+
+## Detailed Findings
+
+### Critical Risk Vulnerabilities
+#### **CRITICAL-01: Cross-Site Scripting (XSS) in Dashboard Interface**
+- **Location**: `static/js/pages/clients.js` (multiple locations).
+- **Description**: User-controlled data (e.g., `client.id`) inserted directly into HTML or `onclick` handlers without escaping.
+- **Impact**: Arbitrary JavaScript execution in admin context, potentially stealing session tokens.
+
+#### **CRITICAL-02: Insecure API Key Storage in Database**
+- **Location**: `src/database/mod.rs`, `src/providers/mod.rs`, `src/dashboard/providers.rs`.
+- **Description**: Provider API keys are stored in **plaintext** in the SQLite database.
+- **Impact**: Compromised database file exposes all provider API keys.
+
+### High Risk Vulnerabilities
+#### **HIGH-01: Missing Input Validation and Size Limits**
+- **Location**: `src/server/mod.rs`, `src/models/mod.rs`.
+- **Impact**: Denial of Service via large payloads.
+
+#### **HIGH-02: Sensitive Data Logging Without Encryption**
+- **Location**: `src/database/mod.rs`, `src/logging/mod.rs`.
+- **Description**: Full request and response bodies stored in `llm_requests` table without encryption or redaction.
+
+#### **HIGH-03: Weak Default Credentials and Password Policy**
+- **Description**: Default admin password is 'admin' with only 4-character minimum password length.
+
+### Medium Risk Vulnerabilities
+#### **MEDIUM-01: Missing CSRF Protection**
+- No CSRF tokens or SameSite cookie attributes for state-changing dashboard endpoints.
+
+#### **MEDIUM-02: Insecure Session Management**
+- Session tokens stored in localStorage without HttpOnly flag.
+- Tokens use simple `session-{uuid}` format.
+
+#### **MEDIUM-03: Error Information Leakage**
+- Internal error details exposed to clients in some cases.
+
+#### **MEDIUM-04: Outdated Dependencies**
+- Outdated versions of `chrono`, `tokio`, and `reqwest`.
+
+### Low Risk Vulnerabilities
+- Missing security headers (CSP, HSTS, X-Frame-Options).
+- Insufficient rate limiting on dashboard authentication.
+- No database encryption at rest.
+
+## Recommendations
+### Immediate Actions
+1. **Fix XSS Vulnerabilities:** Implement proper HTML escaping for all user-controlled data.
+2. **Secure API Key Storage:** Encrypt API keys in database using a library like `ring`.
+3. **Implement Input Validation:** Add maximum payload size limits (e.g., 10MB).
+4. **Improve Data Protection:** Add option to disable request/response body logging.
+
+---
+*Report generated by Security Auditor Agent on March 6, 2026*