Update review state with latest findings and issue tracking

[BodenMcHale]

Summary

This update reflects the results of the latest automated security review run, documenting newly filed issues and updated runner-up findings with refined scoring and issue cross-references.

Key Changes

• Filed Issue [REVIEW] CSP: Content-Security-Policy-Report-Only is invisible to the analyzer — report-only deployments score 0/30 as if no CSP exists #20: CSP Content-Security-Policy-Report-Only header invisibility — the analyzer only checks for 'content-security-policy' header and misses 'content-security-policy-report-only', causing report-only deployments to incorrectly score 0/30 with misleading recommendations
• Updated runner-up tracking: Refined reason_not_filed entries to reference newly opened issues ([REVIEW] CSP: wildcard (*) detection covers only default-src and script-src — connect-src *, form-action *, and mid-policy wildcards silently pass #16, [REVIEW] HSTS: max-age=0 (HSTS revocation) scores status 'good' due to bonus points from includeSubDomains and preload #17, [REVIEW] Referrer-Policy: no-referrer-when-downgrade classified as "strong" — awards full score for the historical browser default that leaks full URLs cross-origin #18) and clarify status of previously duplicate findings
• Documented CI breakage: Added runner-up entry for Permissions-Policy test failures (issue [REVIEW] Permissions-Policy tests: 4 assertions broken by merge regression — main branch CI is red #15) and ESM module compatibility issue in getVersion() (issue [REVIEW] CSP: wildcard (*) detection covers only default-src and script-src — connect-src *, form-action *, and mid-policy wildcards silently pass #16)
• Timestamp updates: Recorded latest review run at 2026-05-26T06:10:00Z with new commit hash

Notable Details

• Issue [REVIEW] CSP: Content-Security-Policy-Report-Only is invisible to the analyzer — report-only deployments score 0/30 as if no CSP exists #20 scored 6.75 with balanced impact assessment (user_impact: 7, security_severity: 5, implementation_effort: 8, evidence_quality: 9)
• Previous runner-up about CSP-Report-Only (score 5.9) has been elevated and filed with refined scoring
• Deduplication notes updated to reflect current issue status and closure of issue [REVIEW] CSP: checkCSP awards full score without verifying base-uri restriction, enabling silent <base> injection bypass #5

https://claude.ai/code/session_01AgPSURQL9rsRLaVAN8jNwA