# Open audit — stakes

member-console is a Go + HTMX membership console for worker cooperatives.
Members sign in through an OIDC provider and buy plans through Stripe; plans
provision resources (federated wiki sites, forum access, custom domains)
through Temporal workflows. Sessions live in Valkey, data in PostgreSQL.
One privileged role exists: operator.

The whole source is in your working directory, a disposable copy: read
anything, run anything. Scanner output is in `/out/tools/` as leads. Decide
for yourself what this system must never allow and how you would attack it
from the internet, as a member, and as a member of another organisation.
Split the work however you like. Read code until you can quote it.

Report in the shape below, and say what you did not get to.