docs: the 2026-10-17 security audit in security.md's history and the roadmap

"After the plan" of docs/security-audit-2026-10-17.md: security.md's
history paragraph names A2 and the seven mediums and what closed them; the
roadmap gets the row security-audit-2026-10-17 (26 of 29 plan lines; stage
H is the owner's host, S4 in progress) and two proposed rows the audit left
as product choices: upstream-tls-verify (M7's optional "secure") and
server-dmarc-hint (S3's product side).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/roadmap.md

@@ -28,6 +28,9 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 
 | ID | Topic | Status | Progress | Plan |
 |---|---|---|---|---|
+| security-audit-2026-10-17 | Follow-ups of the 2026-10-17 security audit: A2 (high), seven mediums, the lows | stages 0-6 built 2026-10-17 for `2.14.4`; stage H (the host, S1-S3, S5) the owner's; S4 (rspamd 4.2) in progress | 26/29 | [security-audit-2026-10-17.md](security-audit-2026-10-17.md) |
+| upstream-tls-verify | Inbound: offer "Verified" TLS to the upstream (Postfix `secure`, the upstream's name checked), beside Required, which checks no certificate (audit M7) | proposed | — | — |
+| server-dmarc-hint | Server › Settings lists a DMARC record for the server's own name beside its DKIM and SPF (audit S3, product side) | proposed | — | — |
 | inbound-upstream-result | Inbound › Log shows what the upstream answered: sent, deferred, bounced, with its last reply | shipped `2.10.0` | 7/7 | [plans/inbound-upstream-result.md](plans/inbound-upstream-result.md) |
 | health-setup-checks | Server › Health also checks the certificate's name, Postfix's greeting and the trusted proxy (was preflight) | shipped `2.11.0` | — | — |
 | test-email | Send a test message from the panel (was preflight) | shipped `2.12.0` | — | — |

docs/security.md

@@ -64,7 +64,22 @@ notification (the server's name is kept in lower case for DKIM); only `From`
 was over-signed (now the shown headers too) - all fixed. `Sender:`, which
 the review found neither held nor signed (F1), is now both: signed, and held
 to the login like `From:` (the owner's decision, 2026-10-16). What the header
-cap leaves is under Accepted risks.
+cap leaves is under Accepted risks. The 2026-10-17 security audit
+([security-audit-2026-10-17.md](security-audit-2026-10-17.md); four zone
+readers, the live server, probes from outside) found no Critical. Its High,
+A2: a stolen `global` session could set its own password on the user form
+and so pass the backup's password check - the user form now asks for the
+signed-in password to add a user or to change a password, an e-mail or a
+role, and to delete one. Its seven Mediums: a stranger reserving a domain's
+level-2 slots through `MAIL FROM` (M1, now the login's domain), a refused
+recipient writing an Inbound log row in a stranger's words (M2, now
+Postfix's own tail), one message as a thousand journal rows uncut (M3), a
+custom DMARC address on the server's name opening an untagged mailbox (W1),
+the TLS key readable by Postfix through group 10998 (I1, now group 10997),
+a link the entrypoint could follow at the DMARC maps (I2), and every
+visitor sharing one sign-in limit behind an untrusted proxy (A1) - all fixed
+in `2.14.4`, with the lows the plan named; two reviews (Fable) of the fixes
+found nothing above low, and their lows were fixed too.
 (2) **Accepted risks** —
 deliberate departures beyond the mandatory, recorded so the decision is not
 lost.