docs: add manual security disclosure collection

[TheDZhon]

The disclosure ledger is missing the August Accounting Oracle / VEBO post-mortem, and there is no repeatable way to compare forum disclosures against it. This adds a manual candidate collector and the reviewed ledger entry.

Stacked on #960. The base is chore/update-audits-and-lips so this PR shows only the disclosure additions. After #960 merges, retarget this PR to main and update its base as needed.

Changes

• Add npm run fetch-disclosures, using docs: add new audit reports and LIP-37 #960's existing lib/http, lib/markdown, and lib/tasks helpers and exported run() convention.
• Discover keyword-matched forum topics, including weakness/weaknesses, within an inclusive UTC activity window, fetch their complete post streams in batches, and compare numeric topic ids against the local ledger.
• Write timestamped reports into the existing ignored .security-triage/ directory, containing source links, ids, dates, hashes, candidates, already-listed topics, routing exclusions, and errors. Do not persist titles, bodies, or author identities.
• Return nonzero for incomplete pagination or failed topic collection. Document that keyword selection and product routing require human review and cannot establish exhaustive disclosure coverage.
• Add the August 6 Accounting Oracle / VEBO post-mortem as Incident / Low, and clarify that the main ledger focuses on Lido's staking business.
• Add mocked regression tests and manual usage documentation.

The existing audit/LIP/quorum fetchers, aggregate fetch command, shared helpers, redirects, dependencies, and CI workflows are unchanged. Live forum collection is a separate manual command; it does not publish ledger rows or assign severity.

Evidence and validation

Source: https://research.lido.fi/t/11756/3 — August 6 is the post-mortem publication date. Low is the reviewed editorial classification.

• npm test: 82 tests passed (70 inherited and 12 new).
• npm run build: passed.
• git diff --check: passed.
• Live collection for March 23–September 11 against docs: add new audit reports and LIP-37 #960's original ledger: candidate 11756, already-listed 11342, nine product/operator exclusions, complete collection, zero errors.
• Live collection for March 23–September 12 against the updated ledger: zero new candidates, two already-listed disclosures, nine exclusions, complete collection, zero errors.

npm run fetch-disclosures
npm run fetch-disclosures -- --since 2026-03-23 --until 2026-09-11

[Copilot]

🟡 Changes recommended

Post-stream validation can incorrectly report complete collection and misclassify a topic using an undeclared post.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds a manual forum disclosure collector and updates the security ledger.

Changes:

• Collects, classifies, hashes, and reports disclosure candidates.
• Adds regression tests and usage documentation.
• Records the Accounting Oracle / VEBO incident.

File summaries

File	Description
scripts/fetch-disclosures.js	Implements disclosure collection and reporting.
tests/fetch-disclosures.test.js	Tests collection behavior and failures.
README.md	Documents manual usage and limitations.
package.json	Adds the collector command.
docs/security/disclosures.md	Adds the reviewed incident entry.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.