docs: add security coverage and pentest section to landing page

- Hero: added 5th stat - 98.9% Test Coverage
- New section between Enterprise Security and CTA:
  Pentest results: 4 vulnerabilities found and fixed
  Coverage dashboard: 98.97% lines, 94.55% funcs, 803 tests, 0 failures
  Fix details: input validation bypass, health check cascade,
    rate limiter bypass, error handler/CORS
- All data backed by actual audit in isolated Docker environment

Author: molty3000

docs/index.html

@@ -237,6 +237,7 @@ <h1 style="font-size:clamp(40px,6vw,64px);font-weight:700;color:#fff;letter-spac
         <div class="stat"><div class="num">&lt;1ms</div><div class="label">Routing Overhead</div></div>
         <div class="stat"><div class="num">8+</div><div class="label">LB Strategies</div></div>
         <div class="stat"><div class="num">TLS 1.3</div><div class="label">Enterprise Security</div></div>
+        <div class="stat"><div class="num">98.9%</div><div class="label">Test Coverage</div></div>
       </div>
 
       <!-- Use Case Carousel -->
@@ -504,6 +505,109 @@ <h2 class="section-title">Battle-tested security defaults</h2>
       </div>
     </section>
 
+    <!-- Security Coverage & Pentest -->
+    <section style="padding:100px 24px;background:#0a0a0b;">
+      <div class="section-inner">
+        <div class="section-label">Security Coverage</div>
+        <h2 class="section-title">Penetration tested. 803 tests. Zero failures.</h2>
+        <p class="section-sub" style="color:#94a3b8;max-width:720px;margin:0 auto 48px;font-size:16px;line-height:1.6;">
+          Bungate underwent a comprehensive security audit in an isolated Docker environment.
+          Every vulnerability found was fixed and verified before shipping. Here's the real data.
+        </p>
+
+        <!-- Pentest Results -->
+        <div class="grid-3" style="margin-bottom:48px;">
+          <div class="card" style="border-left:3px solid #38bdf8;">
+            <div class="card-icon blue" style="font-size:28px;">&#128737;</div>
+            <h3 style="color:#fff;margin:12px 0 4px;font-size:18px;">Pentest Verified</h3>
+            <p style="color:#94a3b8;font-size:14px;line-height:1.55;">
+              Full security audit with exploit simulation: double-encoding traversal, health check cascade DoS, X-Forwarded-For rate limit bypass, CORS evasion. All 4 vulnerabilities <strong style="color:#38bdf8;">found and fixed</strong>.
+            </p>
+          </div>
+          <div class="card" style="border-left:3px solid #22c55e;">
+            <div class="card-icon blue" style="font-size:28px;">&#9989;</div>
+            <h3 style="color:#fff;margin:12px 0 4px;font-size:18px;">Zero Regressions</h3>
+            <p style="color:#94a3b8;font-size:14px;line-height:1.55;">
+              Every security fix validated against the full 803-test suite. <strong style="color:#22c55e;">633 to 803 tests</strong> during coverage improvement. Zero pre-existing tests broken by security patches.
+            </p>
+          </div>
+          <div class="card" style="border-left:3px solid #a78bfa;">
+            <div class="card-icon blue" style="font-size:28px;">&#128300;</div>
+            <h3 style="color:#fff;margin:12px 0 4px;font-size:18px;">Recursive Decode Engine</h3>
+            <p style="color:#94a3b8;font-size:14px;line-height:1.55;">
+              Custom <code style="color:#a78bfa;">recursiveDecodeURIComponent()</code> defeats multi-layer encoding attacks (<code>%252f</code> to <code>%2f</code> to <code>/</code>). Two-pass validation: raw path then fully-decoded path.
+            </p>
+          </div>
+        </div>
+
+        <!-- Coverage Stats -->
+        <div style="background:rgba(56,189,248,0.04);border:1px solid rgba(56,189,248,0.12);border-radius:16px;padding:40px 48px;margin-bottom:32px;">
+          <div style="display:flex;gap:48px;flex-wrap:wrap;justify-content:center;align-items:center;">
+            <div style="text-align:center;">
+              <div style="font-family:'JetBrains Mono',monospace;font-size:48px;font-weight:800;color:#22c55e;">98.97%</div>
+              <div style="color:#94a3b8;font-size:13px;margin-top:4px;">Line Coverage</div>
+            </div>
+            <div style="text-align:center;">
+              <div style="font-family:'JetBrains Mono',monospace;font-size:48px;font-weight:800;color:#38bdf8;">94.55%</div>
+              <div style="color:#94a3b8;font-size:13px;margin-top:4px;">Function Coverage</div>
+            </div>
+            <div style="text-align:center;">
+              <div style="font-family:'JetBrains Mono',monospace;font-size:48px;font-weight:800;color:#a78bfa;">803</div>
+              <div style="color:#94a3b8;font-size:13px;margin-top:4px;">Tests (44 files)</div>
+            </div>
+            <div style="text-align:center;">
+              <div style="font-family:'JetBrains Mono',monospace;font-size:48px;font-weight:800;color:#f59e0b;">0</div>
+              <div style="color:#94a3b8;font-size:13px;margin-top:4px;">Failures</div>
+            </div>
+          </div>
+        </div>
+
+        <!-- Security Fix Details -->
+        <div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px;">
+          <div style="background:#0f0f12;border:1px solid #1a1a1f;border-radius:12px;padding:20px 24px;">
+            <div style="display:flex;align-items:center;gap:10px;margin-bottom:8px;">
+              <span style="font-size:20px;">&#128274;</span>
+              <span style="color:#fff;font-weight:600;font-size:15px;">Input Validation</span>
+              <span style="background:rgba(239,68,68,0.15);color:#ef4444;font-size:11px;padding:2px 8px;border-radius:10px;margin-left:auto;">FIXED</span>
+            </div>
+            <p style="color:#94a3b8;font-size:13px;line-height:1.55;margin:0;">
+              Double-encoding (<code>%252f</code>) and quad-dot traversal now defeated by recursive decode + two-pass validation + expanded blocked patterns.
+            </p>
+          </div>
+          <div style="background:#0f0f12;border:1px solid #1a1a1f;border-radius:12px;padding:20px 24px;">
+            <div style="display:flex;align-items:center;gap:10px;margin-bottom:8px;">
+              <span style="font-size:20px;">&#9878;</span>
+              <span style="color:#fff;font-weight:600;font-size:15px;">Cascade Failure</span>
+              <span style="background:rgba(239,68,68,0.15);color:#ef4444;font-size:11px;padding:2px 8px;border-radius:10px;margin-left:auto;">FIXED</span>
+            </div>
+            <p style="color:#94a3b8;font-size:13px;line-height:1.55;margin:0;">
+              Threshold-based health checks: 3 consecutive failures to mark unhealthy, 2 successes to recover. Min-healthy floor prevents complete cascade.
+            </p>
+          </div>
+          <div style="background:#0f0f12;border:1px solid #1a1a1f;border-radius:12px;padding:20px 24px;">
+            <div style="display:flex;align-items:center;gap:10px;margin-bottom:8px;">
+              <span style="font-size:20px;">&#128200;</span>
+              <span style="color:#fff;font-weight:600;font-size:15px;">Rate Limit Bypass</span>
+              <span style="background:rgba(245,158,11,0.15);color:#f59e0b;font-size:11px;padding:2px 8px;border-radius:10px;margin-left:auto;">FIXED</span>
+            </div>
+            <p style="color:#94a3b8;font-size:13px;line-height:1.55;margin:0;">
+              Rate limiter now keys on the gateway's <code>getClientIP()</code> via trusted proxy validator. X-Forwarded-For rotation no longer bypasses limits.
+            </p>
+          </div>
+          <div style="background:#0f0f12;border:1px solid #1a1a1f;border-radius:12px;padding:20px 24px;">
+            <div style="display:flex;align-items:center;gap:10px;margin-bottom:8px;">
+              <span style="font-size:20px;">&#127760;</span>
+              <span style="color:#fff;font-weight:600;font-size:15px;">Error Handler</span>
+              <span style="background:rgba(245,158,11,0.15);color:#f59e0b;font-size:11px;padding:2px 8px;border-radius:10px;margin-left:auto;">FIXED</span>
+            </div>
+            <p style="color:#94a3b8;font-size:13px;line-height:1.55;margin:0;">
+              Global error handler properly catches exceptions. CORS preflight returns clean 204. No more stack trace or internal file path leakage.
+            </p>
+          </div>
+        </div>
+      </div>
+    </section>
+
     <!-- CTA -->
     <section style="text-align:center;padding:100px 24px 120px;background:radial-gradient(ellipse at 50% 50%, rgba(56,189,248,0.05) 0%, transparent 70%);">
       <h2 style="font-size:clamp(28px,3.5vw,40px);font-weight:700;color:#fff;letter-spacing:-1px;margin-bottom:12px;">Ready to ship faster?</h2>