Add security and CI remediation plan

[PeterRounce]

What

Adds docs/plans/2026-08-12-security-and-ci-remediation.md. Documents only — no code, config, or workflow is touched.

Why

Records the six outstanding items found while auditing this repo for CVE-2026-71851 ("Ill Bloom"), so they don't live only in a chat log. Kept separate from #31 and #30 so those stay easy to approve on their mechanical merits.

#	Item	Severity	State
1	CI dead — deprecated actions	blocker	#31
2	CI dead — npm install fails building rn-ldk git dep	blocker	diagnosed
3	crypto-js 4.1.1 → 4.2.0 (CVE-2023-46233)	low	#30
4	Wallet-at-rest KDF is MD5 with 1 iteration	high	at decision point
5	getRealm() unsalted SHA-256 + hardcoded default key	medium	diagnosed
6	crypto-js discontinued upstream	low	no action proposed

Recommended order is 1 → 2 → 3 → 4 (with 5 folded in), because nothing can be test-gated until CI runs.

Headline for anyone skimming

This repo is not, and never was, exposed to Ill Bloom. CVE-2026-71851 affects crypto-js < 4.0.0; this repo has always been on 4.x. class/Ntag424.js does reference CryptoJS.lib.WordArray — the symbol named in that advisory — but uses .init() to build word arrays for an XOR, not .random(). No seed or key entropy here comes from crypto-js.

The genuinely high-severity item is 4, which is unrelated to any advisory: blue_modules/encryption.js calls AES.encrypt(data, passwordString), and passing a string password routes through OpenSSL EvpKDF — MD5, one iteration, 8-byte salt. Password guessing against a stolen storage blob costs roughly one MD5 per attempt. No crypto-js version changes this.

How to read it

Each open item lists options with trade-offs and a recommendation, rather than a pre-made decision — the choices are still yours. Item 4 also records three design decisions already taken that aren't recoverable from the code (fork-only/mergeable, drop decoy buckets, block migration for multi-bucket users).

Two sections are there specifically to stop this doc creating false confidence:

• Expectations — items 1 and 2 make CI able to run; they do not imply the suite passes. Item 1 predates item 2, which predates TS 5.0, so real failures have likely accumulated underneath.
• Out of scope — this is one audit thread plus what it happened to surface. It is not a security review of this repo. Items 4 and 5 were found only because those files were open for other reasons.

Note on CI

Checks on this PR will fail at Install node_modules — that's item 2, present on master and unrelated to a markdown file. It'll keep happening to every PR until item 2 is fixed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L9eFm5MqyhJZvzN2tNopAU