docs: update security reports

.github/SECURITY_ADVISORY_DUPLICATES.md

@@ -107,6 +107,24 @@ No known duplicates.
 
 ---
 
+## PasswordHash argon2 resource exhaustion / login lockout
+
+**Canonical:** [GHSA-pc8g-78pf-4xrp](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp) / CVE-2026-28342 — reporter **fg0x0** (2026-02-25)
+
+Unauthenticated `PasswordHash` performs Argon2id hashing. Fixed in CVE-2026-28342 by a 10-slot semaphore shared with `LocalUserLogin`. Later reports argue that saturating the shared pool denies logins; this is the intended fail-fast trade-off and is not accepted as a separate vulnerability.
+
+| GHSA | Reporter | Status | Notes |
+|------|----------|--------|-------|
+| GHSA-pc8g-78pf-4xrp | fg0x0 | published (canonical) | Unbounded memory; fixed by semaphore |
+| GHSA-j746-2pj2-p94h | 0xkakash1 | closed | CPU exhaustion, post-fix |
+| GHSA-r2h8-8h64-fxx8 | offset | closed | Shared pool denies `LocalUserLogin` |
+| GHSA-p7jx-32j2-jq49 | fg0x0 | closed | Shared pool denies `LocalUserLogin` |
+| GHSA-8656-625g-3h52 | muzi5622 | closed | Shared pool denies `LocalUserLogin` |
+
+**Why not accepted:** the endpoint is intentionally unauthenticated (documented hashing utility, needed before any user exists); worst case is bounded at ~640 MiB and 10 concurrent hashes; login refusal lasts only while the flood is sustained, with no bypass or C/I impact. Volumetric floods belong to reverse-proxy rate limiting.
+
+---
+
 ## Easy to confuse (not duplicates)
 
 | Topic | Advisories | Distinction |

SECURITY.md

@@ -58,6 +58,12 @@ If you are reporting via GitHub Security Advisories, search existing [repository
 
 Maintainers: see [.github/SECURITY_ADVISORY_DUPLICATES.md](.github/SECURITY_ADVISORY_DUPLICATES.md) for known duplicate pairs, triage steps, and OAuth2 issues that are easy to confuse with each other.
 
+## Known behaviour that is not considered a vulnerability
+
+The following have been reported several times and reviewed. Please only report them if you have found something beyond what is described here.
+
+* **`PasswordHash` is unauthenticated and can make local login busy.** The `PasswordHash` API is a documented utility for generating Argon2id hashes, and is needed before any user exists. Unbounded resource use was fixed in CVE-2026-28342 by limiting all Argon2id work, including `LocalUserLogin`, to 10 concurrent operations. Flooding `PasswordHash` can make logins return `ResourceExhausted` while the flood continues; this fail-fast behaviour is intentional, keeps memory bounded, and has no lasting effect. Rate limit request floods at your reverse proxy.
+
 ## Process
 
 Once a vulnerability is reported, the process is;