Triage #403 findings: close replay-protection test gap, defer/redirect the rest to scoped issues

[Copilot]

Issue #403 flagged eight E2EE concerns (RSA usage, MITM, unencrypted files, metadata leakage, no identity verification, replay attacks, etc.). Re-auditing against current master, most bullets are already resolved by prior work (RSA removal, pluggable EncryptionStrategy, invite secret confined to the URL fragment, chat ReplayGuard) — only WebRTC signaling replay protection lacked test coverage, and two items (identity verification, forward secrecy) needed to be split into their own scoped issues rather than bundled into a "redo the protocol" effort.

• Test coverage

  • Added tests in service/src/sdk.test.ts confirming isStaleSignal/lastSignalSeqByCall reject duplicate and out-of-order sequence numbers on incoming WebRTC signaling envelopes, mirroring the existing chat-message replay test.
  • Covers: decrypt-and-deliver happy path, duplicate seq drop, out-of-order seq drop, and correct per-call-id isolation (a lower seq on a different call is not treated as stale).

• Metadata audit

  • Reviewed socket.ts/sdk.ts wire payloads; found no avoidable plaintext beyond what routing requires (chatJoinPayloadType already omits userName, envelopes carry only version/strategy/opaque data).

• Issue triage (no code changes needed)

  • Confirmed RSA-OAEP and AES key should be encrypted before exchange #378 bullets are stale relative to current architecture.
  • Filed follow-ups for the genuinely open items: safety-number/fingerprint verification UI and forward-secrecy/ratcheting evaluation, so each can land as an independent, reviewable change.
  • Flagged an open PR that targets files no longer present in the current architecture and will need a rebase.
  • Noted that file encryption should be a built-in requirement of the (not-yet-implemented) file-sending feature, using the existing EncryptionStrategy interface rather than a bolted-on scheme.

No production code was changed — the signaling replay logic was already correct, only its test coverage was missing.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud