Security Audits & Reports

LumoAuth is reviewed on a recurring basis, and every finding is tracked to a fix. This page lists what was reviewed, when, and where the detailed reports live. Exploit details are deliberately not published here; the categories and outcomes are.

Where to find the full reports

The documents named below live in the private LumoAuth source repository, not in this docs tree or the published package. Request access via the LumoAuth team or the repository at github.com/lumoauth/lumoauth. The filenames are listed so you can locate them once you have access.

---

Review history

2026-09-28: Release readiness review and remediation

Scope. A third pre-release pass after the 2026-09-16 and 2026-09-25 reviews: automated gates (test suite, composer audit, importmap:audit, container / Twig / YAML lint, schema validation, static analysis) plus six parallel source-to-sink reviews: re-verification of advertised-but-unimplemented features, end-user account safeguards, a template / CSRF / XSS sweep, a tenant-isolation sweep of about 520 id-loading actions, production configuration and operations, and data protection.

Headline outcome. Seven release blockers were found and fixed, among them platform e-mail sent from an undeliverable sender (the sender address is now validated at boot), a SCIM /Me path that let the provisioning token change an admin's password, SAML accounts matched by NameID without the issuing IdP, and a GDPR lifecycle job that ignored each organization's own retention settings. The remaining findings (token revocation, refresh-token policy, scope-gated claims, JIT human-in-the-loop, Zanzibar plan gating, account-recovery and registration safeguards, erasure coverage, key rotation) were fixed in the same remediation. Behaviour changes are in the release notes.

2026-09-16: Independent pre-release review and same-day remediation

Scope. A full source-to-sink review of the codebase in eight parallel passes:

Area	What was checked
Organization isolation	Every organization-scoped lookup on the portal, Admin API, B2B, SCIM, agent and OAuth paths
Authentication and login	Form, hosted OAuth, LDAP, social and passkey login; session creation; lockout and rate limits
Authorization and privilege escalation	Admin API scopes, role assignment paths, settings write paths, JIT approvals
OAuth / OIDC	Issuer consistency, redirect and client validation, DPoP, token types accepted per endpoint
Agent identity	AAuth, JIT, workload attestation and MCP token handling
Federation and integrations	SAML, SCIM, LDAP, webhooks, approval channels, outbound URL safety
Information disclosure	Error rendering, enumeration oracles, debug and profiler exposure
Injection, crypto and supply chain	Secrets at rest, hashing, dependency advisories, runtime configuration
Browser security	CSRF on state-changing routes, cookies, CSP, sanitizers, logout

Headline outcome.

• No cross-organization data access was found. All organization-scoped reads and writes were confirmed to be bound to the caller's organization.
• Session, scope and login hardening shipped the same day: API keys and Bearer tokens no longer create browser sessions and are refused on session-only pages; OAuth access tokens need an admin scope on the Admin API; the Admin API fails closed for any action without a declared scope; the hosted OAuth login page gets the same CSRF, lockout and rate limits as the form login; passkeys require user verification; POST /logout requires a CSRF token. See Credentials and access model.
• SCIM bearer authentication now requires an access token with the scim scope (or the provisioning token) and refuses ID, logout, JIT and agent tokens; SCIM Basic auth is refused for MFA-enrolled users; the per-organization SCIM policy toggles are enforced by the API.
• Client-certificate headers are only trusted behind an explicitly declared mTLS-terminating proxy; bootstrap (app:init-admin) refuses to run against a squatted admin e-mail; organization settings writes are allow-listed; push and consent tokens are hashed at rest; the platform encryption key is required at production boot.
• Dependency advisories went from 41 to 0 by updating the lock file (no constraint changes). A weekly composer audit CI job now guards the lock: .github/workflows/security-audit.yml runs on every pull request, on main, and every Monday, and fails on any new advisory.

Verification. The full PHPUnit suite (3381 tests), container, YAML and Twig lint, static analysis and the documentation link check all passed after remediation; 50 new test files cover the fixed paths.

Where to read more.

• Remediation summary and behaviour changes for integrators: release notes and Credentials and access model.
• Full report (private repository): SECURITY_REVIEW_2026-09-16.md, with a finding-by-finding remediation table.

2026-07: Security audit remediation

Fixes for DPoP downgrade, policies.create privilege and agent-card SSRF findings; four low-severity findings were deferred with documented rationale. Report (private repository): SECURITY_AUDIT_REPORT.md and SECURITY_AUDIT_SUMMARY.md.

---

Reports

Document	Description
RELEASE_READINESS_REVIEW_2026-09-28.md	Release readiness review: automated gates, P0–P2 findings
SECURITY_REVIEW_2026-09-25.md	Second pre-release security review and owner decisions
SECURITY_REVIEW_2026-09-16.md	Independent pre-release review, remediation table, behaviour changes
SECURITY_AUDIT_REPORT.md	Comprehensive security audit findings
SECURITY_AUDIT_SUMMARY.md	Executive summary of audit results
SECURITY_EXPLOIT_AUDIT.md	Exploit testing and vulnerability analysis
SECURITY_FIXES_CHECKLIST.md	Tracking fix progress for identified issues
CRITICAL_SECURITY_ACTIONS.md	High-priority security remediation items

Implementation

Document	Description
SECURITY_IMPLEMENTATION_SUMMARY.md	Overview of implemented security measures
SECURITY_IMPLEMENTATION_README.md	Detailed implementation guide
TENANT_SECURITY_FIXES_IMPLEMENTATION.md	Organization isolation security improvements
DATABASE_INDEXES_IMPLEMENTATION.md	Performance and security indexes

Architecture

Document	Description
ARCHITECTURE_IMPROVEMENTS.md	Architectural changes for security and scalability

Continuous checks

Check	Where	Cadence
composer audit --no-dev --locked	.github/workflows/security-audit.yml	Every PR touching the lock, every push to main, weekly
Admin API scope coverage (every admin route declares a scope)	tests/Integration/Security/AdminApiKeyScopeCoverageTest.php	Every test run
Credential statelessness (no session from API key or Bearer)	tests/Integration/Security/CredentialStatelessAuthTest.php	Every test run