Add OSS Scanner build image and threat model (#4995)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.oss-scanner/Dockerfile

@@ -0,0 +1,40 @@
+# Copyright 2026 LiveKit, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Build image for Anthropic's OSS Scanner. Keep the Go version at or above go.mod's: GOTOOLCHAIN=local won't fetch one.
+FROM golang:1.26-bookworm
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    GOTOOLCHAIN=local
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      build-essential ca-certificates git redis-server \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+COPY . /src
+
+RUN go mod download && go mod verify
+RUN go build ./... && go build -o /usr/local/bin/livekit-server ./cmd/server
+
+# Tests use a local redis on :6379; pkg/service also wants a docker daemon unless -docker=false.
+RUN redis-server --daemonize yes \
+    && go test -count=1 -timeout 20m $(go list ./... | grep -v '/pkg/service$') \
+    && go test -count=1 -timeout 10m ./pkg/service -docker=false \
+    || echo 'WARNING: baseline tests failed'
+
+ENV GOPROXY=off \
+    GOSUMDB=off
+
+CMD ["bash"]

.oss-scanner/threat_model.md

@@ -0,0 +1,84 @@
+# LiveKit server threat model
+
+LiveKit server is a WebRTC SFU written in Go. Clients join rooms with a signed
+access token, publish and subscribe to audio, video, and data tracks, and exchange
+signalling over WebSocket or HTTP. Operators manage rooms, participants, egress,
+ingress, SIP, and agent dispatch through a Twirp API authenticated by API
+key/secret. The server also embeds a TURN server.
+
+## Scope and trust boundaries
+
+Audit the server on `master`: signalling (`pkg/service`, `pkg/rtc/signalling`),
+room and participant state (`pkg/rtc`), media forwarding (`pkg/sfu`), routing
+(`pkg/routing`), the agent endpoint (`pkg/agent`), WHIP, WebTransport, and TURN.
+
+Untrusted parties:
+
+- Unauthenticated network clients, against every HTTP, WebSocket, WebTransport,
+  TURN, and UDP/TCP media port.
+- Participants holding a valid token for one room. Their signalling messages,
+  SDP, ICE candidates, RTP/RTCP, data-channel packets, metadata, and attributes
+  are untrusted.
+- Holders of tokens with restricted grants (subscribe-only, no data publish,
+  hidden, limited `canPublishSources`, and similar).
+
+Trusted: the operator, the server config file, the API secret, and redis.
+Treat a compromised redis or a leaked API secret as out of scope.
+
+`pion/dtls` is enrolled separately. Report DTLS bugs there, unless LiveKit
+misuses the library.
+
+## Security properties
+
+- **Token and grant enforcement:** a token for one room must not reach another
+  room. Grants must be enforced on every signalling path, including permission
+  updates pushed after join. A participant must not impersonate another identity
+  or act on another participant's tracks.
+- **Media and data isolation:** a participant must not receive tracks or data
+  packets they are not subscribed to or permitted to see. Data packets with
+  destination identities must reach only those identities.
+- **TURN:** relay allocations must not reach arbitrary hosts or ports beyond the
+  configured relay policy.
+- **Parsing:** SDP, RTP header extensions, RTCP, codec payload munging, and
+  protobuf signalling must not panic, corrupt state, or read out of bounds on
+  malformed input.
+- **Resource use:** one participant or unauthenticated client must not exhaust
+  memory, goroutines, or CPU for the whole process.
+
+## Severity guidance
+
+- **Critical:** unauthenticated remote code execution, or an authentication or
+  room-isolation bypass that needs no valid token.
+- **High:** cross-room or cross-participant access to media or data, privilege
+  escalation beyond the token's grants, or a remote crash of the whole process
+  that needs at most an ordinary participant token.
+- **Medium:** denial of service that takes significant traffic, or affects only
+  the attacker's own room. Information leaks of metadata.
+- **Low / not a finding:** a participant degrading their own session; behavior
+  needing the API secret, operator config, or redis access; bandwidth estimation
+  or quality tuning; packet loss and reordering handled as designed.
+
+## Testing
+
+The checkout is at `/src`. The server binary is at `/usr/local/bin/livekit-server`.
+Go dependencies are cached. `GOPROXY=off` and `GOSUMDB=off` prevent downloads.
+Tests expect redis on `localhost:6379`. Start it first. No docker daemon is
+available, so pass `-docker=false` to `pkg/service`.
+
+```sh
+cd /src
+redis-server --daemonize yes
+go test -count=1 $(go list ./... | grep -v '/pkg/service$')
+go test -count=1 ./pkg/service -docker=false
+go test -race -count=1 ./pkg/rtc/... ./pkg/sfu/...
+```
+
+`test/` holds end-to-end tests that run real server instances against local
+clients. Use them for signalling or permission reproducers. Use unit tests in
+the affected package for parsing bugs.
+
+## Reports
+
+State the attacker's required access (none, any valid token, or a specific
+grant), the entry point, and the demonstrated impact. Provide a minimal
+reproducer, preferably a Go test.