docs: reconcile audit trail and fix stale references before mainnet launch

README.md

@@ -56,7 +56,7 @@ Deployment details, environment matrix, and chain configuration: [`docs/RUNBOOK.
 
 ## Security
 
-- The escrow went through a detailed internal security review with all findings fixed: [`docs/security/2026-07-12-cofferescrow-audit.md`](docs/security/2026-07-12-cofferescrow-audit.md). That review also recommends a professional third-party audit; one has not been performed yet. Judge your deposits accordingly — the contract is deliberately small, escape hatches (unilateral withdraw) are always available outside the 24-hour execution lock, and the code is fully public.
+- The escrow went through a detailed internal security review with all findings fixed, plus a round of external AI-driven review with a public response: [`docs/security/2026-07-17-external-audit-response.md`](docs/security/2026-07-17-external-audit-response.md). Two more automated scans are in [`docs/security/`](docs/security/) (`2026-07-22-1dollar-audit-report.md`, `2026-07-22-nethermind-audit-agent-report.pdf`); their findings are under triage. No formal manual third-party audit has been performed yet. Judge your deposits accordingly — the contract is deliberately small, escape hatches (unilateral withdraw) are always available outside the 24-hour execution lock, and the code is fully public.
 - The app is non-custodial: the server coordinates signatures and metadata but never holds funds, and clients independently verify the transaction they are asked to sign.
 - Found a vulnerability? Please report it privately to the Namespace team rather than opening a public issue.
 

apps/web/app/legal/risks/page.tsx

@@ -40,11 +40,17 @@ export default function RisksPage() {
               )
             </>
           ) : null}{" "}
-          is open source and has been{" "}
-          <a href="https://onedollaraudit.com" rel="noreferrer" target="_blank">
-            externally audited
+          is open source. It has had an internal security review with all findings fixed, plus automated AI-driven
+          scans from external tools; their reports are public in{" "}
+          <a
+            href="https://github.com/thenamespace/ens-diamonds/tree/main/docs/security"
+            rel="noreferrer"
+            target="_blank"
+          >
+            docs/security
           </a>
-          . An audit reduces risk; it does not eliminate it. Smart contracts can contain undiscovered defects, and this
+          . None of this is a substitute for a formal manual audit, which has not yet been performed. Smart contracts
+          can contain undiscovered defects, and this
           one is <strong>immutable by design</strong>: no administrator, no pause switch, no upgrade path. If a defect
           is ever found, there is no one who can freeze the contract or recover funds. The same applies to the ENS and
           Safe contracts the flow depends on.

apps/web/app/legal/terms/page.tsx

@@ -129,8 +129,9 @@ export default function TermsPage() {
           THE INTERFACE IS PROVIDED “AS IS” AND “AS AVAILABLE”, WITHOUT WARRANTIES OF ANY KIND,
           EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO
           NOT WARRANT THAT THE INTERFACE WILL BE AVAILABLE, ERROR-FREE, OR SECURE, THAT DISPLAYED DATA IS ACCURATE, OR
-          THAT THE SMART CONTRACTS ARE FREE OF DEFECTS. THE ESCROW CONTRACT HAS BEEN AUDITED; AN AUDIT IS NOT A
-          GUARANTEE.
+          THAT THE SMART CONTRACTS ARE FREE OF DEFECTS. THE ESCROW CONTRACT HAS UNDERGONE INTERNAL AND AUTOMATED
+          SECURITY REVIEW BUT HAS NOT BEEN THE SUBJECT OF A FORMAL THIRD-PARTY AUDIT; NO REVIEW IS A GUARANTEE OF
+          SECURITY.
         </P>
       </Section>
 

docs/RUNBOOK.md

@@ -1,7 +1,7 @@
 # ens.diamonds — Deployment Runbook
 
 Operational guide for deploying ens.diamonds to **Sepolia** and **mainnet**. Pairs
-with `docs/STATUS.md` (state/handoff) and `apps/web/.env.example` (env template).
+with `apps/web/.env.example` (env template) and the audit trail in `docs/security/`.
 
 > **Golden rule — one build per chain.** `NEXT_PUBLIC_APP_CHAIN` and every
 > `NEXT_PUBLIC_*` address are inlined into the JS bundle at build time. You
@@ -128,7 +128,8 @@ Steps (in `packages/contracts`, with a funded `DEPLOYER_PRIVATE_KEY`):
    in the environment (not currently in `.env.example`); otherwise omit
    `--verify` and verify the contract manually afterward.
 5. Record the deployed address → set `NEXT_PUBLIC_ESCROW_ADDRESS` on the mainnet
-   Vercel project and update `docs/STATUS.md`. If the directory ever uses a
+   Vercel project and update the escrow address in README.md's Contracts table.
+   If the directory ever uses a
    deploy-block bound again, set the mainnet value (`ESCROW_DEPLOY_BLOCK` in
    `lib/chain.ts` is currently a dead Sepolia-only constant).