Every previous audit looked at one growing app on one or two servers. This one is the first pass since Licensing shipped, which meant looking at three separate servers and repositories at once, including the licence server, which had not been audited before.
Two things needed fixing, both in the newest and least-scrutinized code.
The bigger one: the check that ties a licence to one install relied partly on information the client reported about itself. A check that trusts the caller’s own claim can’t enforce much, so it now uses details observed server-side instead.
The smaller one: two new public endpoints had no rate limiting. Both are throttled now — generous for anything a real install does, a real brake on anything scripted.
Everything else new got the same scrutiny and came back clean: payment webhooks are signature-verified and fail closed, Cron Jobs has validation at several layers including an independent re-check on the privileged side, and the backup restore path computes downloadable filenames from stored data rather than from anything a request supplies.
One design question was re-examined rather than just re-read: does a lapsed licence lock KNJ Webmail along with everything else? It doesn’t, deliberately. Webmail is how a customer reads mail that already exists on the server, so it stays out of licence enforcement for the same reason SSL renewal and cron jobs do.
All repositories’ full git history was scanned for anything that should never have been committed, including the licence server’s, for the first time. Nothing was found. Live state on all three servers was reverified against the deployed code, and all test suites are green.