MEDIUM. Room codes ~40 bits (weak online enumeration) -> >=128-bit. Rate-limit key is attacker-chosen 'from', not per-IP -> add per-IP. Plus L1 (peers count leaks group size), L2 (no global memory ceiling), L3 (HEAD returns body). NOTE: sender authentication / DKG-seat auth moved to #65 (invite/joiner auth); relay dedup (M3) tracked in #59. Ref: temp/relay-security-audit.md.
MEDIUM. Room codes ~40 bits (weak online enumeration) -> >=128-bit. Rate-limit key is attacker-chosen 'from', not per-IP -> add per-IP. Plus L1 (peers count leaks group size), L2 (no global memory ceiling), L3 (HEAD returns body). NOTE: sender authentication / DKG-seat auth moved to #65 (invite/joiner auth); relay dedup (M3) tracked in #59. Ref: temp/relay-security-audit.md.