Add exhaustive codebase risk assessment reports

Author: MStarRobotics

docs/codebase-risk-assessment.md

@@ -0,0 +1,29 @@
+# Codebase Risk Assessment (LifeLine)
+
+Date: 2026-03-10
+Scope: Backend, Frontend, and Documentation
+Method: Static review of code paths and configuration. No runtime tests executed.
+
+## Executive Summary
+
+This assessment is split into subsystem reports:
+- `docs/risk-assessment-backend.md`
+- `docs/risk-assessment-frontend.md`
+- `docs/risk-assessment-doc-mismatches.md`
+
+## Top Critical/High Risks (Consolidated)
+
+1. Auth vulnerabilities: password reset plaintext storage, check-email token issuance, and unverified social login (backend).
+2. Missing auth/authorization on several REST and socket paths (backend).
+3. Socket impersonation and unauthorized subscriptions (backend).
+4. Helper assignment ID mismatch in socket SOS flow (backend).
+5. Location/medical/payment endpoints allow cross-user access (backend).
+6. Frontend uses `check-email` as a login path when tokens are returned (frontend).
+7. Notifications UI calls a non-existent endpoint (frontend).
+8. Client-side Sarvam API usage uses non-public keys (frontend).
+
+## Next Steps
+
+- Follow the “Suggested Fix Order” in the backend report to reduce attack surface first.
+- Align frontend auth flows with backend security fixes.
+- Regenerate stale API mismatch docs once code changes land.