# Security Notes

## OAuth keys

The security scan flagged `storage/oauth-private.key` as an asymmetric private key. In this remediation round, Passport keys are rotated and loaded from `PASSPORT_KEYS_PATH`, defaulting to `../thaihos-secrets/passport` outside the repository workspace.

After rotation, existing Passport tokens may need to be re-issued and users may need to sign in again. Do not commit generated key files; provide them through deployment secrets or a mounted path.

## Residual dependency risk

Composer dependencies were moved to Laravel 12.64.0 to clear Laravel framework advisories reported against Laravel 8/10. `composer audit` reports no security vulnerability advisories after the upgrade.

npm audit findings were cleared for the root package and module lockfiles checked during this remediation round.

- Laravel Mix 6, webpack 5, and explicit overrides are used for vulnerable transitive build packages where compatible.
- Remove public asset `package.json` and `package-lock.json` files from tracked/deployed assets because they are not runtime assets and create noisy dependency findings.