docs: update security testing status with completed tests

- Add race condition testing results (HEAD triggers burn-after-read)
- Add timing attack analysis (PBKDF2 constant-time verified)
- Mark RPM, AVI, WAV MIME signatures as fixed
- Update security controls table with new verifications

documentation/security-testing-status.md

@@ -37,6 +37,28 @@ Tracking security testing progress and remaining tasks.
 | SVG + Script | XML with embedded script | Served as text/plain |
 | JPEG + PHP | JFIF + PHP code | Served as image/jpeg |
 
+### Race Condition Testing
+
+| Test | Method | Result |
+|------|--------|--------|
+| Burn-after-read bypass | HEAD then GET | SAFE - HEAD triggers deletion |
+
+Verified via server logs: `Burn-after-read paste deleted via HEAD: <id>`
+
+### Timing Attack Analysis
+
+Tested authentication endpoints for timing oracle vulnerabilities (2025-12-25):
+
+| Endpoint | Test | Variance | Result |
+|----------|------|----------|--------|
+| Password verification | Correct vs Wrong | 2.3% | SAFE |
+| Password verification | Correct vs None | 2.1% | SAFE |
+| Paste existence | Valid vs Invalid ID | Expected | OK (DB lookup) |
+| Auth header | Valid vs Invalid format | Expected | OK (DB lookup) |
+
+Password verification uses PBKDF2 with 600,000 iterations (~900ms constant-time).
+No password oracle vulnerability - timing variance within acceptable bounds.
+
 ---
 
 ## Remaining Tasks
@@ -66,16 +88,18 @@ Tested on production (2025-12-25):
 [x] MachO-64 (application/x-mach-binary) PASS
 
 Fallback to text/plain (safe default):
-[~] AVI  - RIFF container, only WEBP subtype checked
 [~] MOV  - ftyp offset varies
-[~] WAV  - RIFF container, only WEBP subtype checked
 [~] CAB  - Signature not implemented
 [~] DEB  - Signature not implemented
 [~] AR   - Signature not implemented
 
+Fixed (2025-12-25):
+[x] RPM  - Added signature (0xEDABEEDB)
+[x] AVI  - Fixed RIFF subtype detection
+[x] WAV  - Fixed RIFF subtype detection
+
 Known issues:
-[!] RPM  - Signature missing (0xEDABEEDB)
-[!] JavaClass - Detected as Mach-O (0xCAFEBABE collision)
+[!] JavaClass - Detected as Mach-O (0xCAFEBABE collision, unfixable)
 
 Not tested (no signature defined):
 [ ] AVIF, HEIC, MKV, TAR, DMG, ISO, DOCX/XLSX/PPTX, ODF
@@ -88,13 +112,13 @@ Not tested (no signature defined):
 [ ] Implement adaptive rate limiting in production fuzzer
 [ ] Add hypothesis property-based tests for MIME detection
 [ ] Create polyglot generator for automated MIME confusion testing
-[ ] Add timing attack tests for authentication endpoints
+[x] Add timing attack tests for authentication endpoints
 ```
 
 ### Penetration Testing (from PENTEST_PLAN.md)
 
 ```
-[ ] Race condition: Burn-after-read via HEAD then GET
+[x] Race condition: Burn-after-read via HEAD then GET (SAFE)
 [ ] Race condition: Content hash deduplication counter
 [ ] DoS: Memory exhaustion via unique IP rate limits
 [ ] DoS: Anti-flood list growth under load
@@ -141,11 +165,14 @@ python /tmp/prod_fuzz.py
 | X-Content-Type-Options | nosniff | Yes |
 | Content-Security-Policy | default-src 'none' | Yes |
 | X-Frame-Options | DENY | Yes |
-| Magic byte detection | First 16 bytes, 42 signatures | Yes |
+| Magic byte detection | First 16 bytes, 45 signatures | Yes |
 | Input sanitization | Werkzeug header handling | Yes |
 | SQL injection prevention | SQLAlchemy parameterized queries | Yes |
 | SSTI prevention | No user content in templates | Yes |
 | Path traversal prevention | ID validation regex | Yes |
+| Constant-time password check | PBKDF2 600k iterations | Yes |
+| Burn-after-read race condition | HEAD triggers deletion | Yes |
+| RIFF container detection | Subtype check (WEBP/AVI/WAVE) | Yes |
 
 ---