diff --git a/.planning/phases/19.1-chat-satellites/19.1-SECURITY.md b/.planning/phases/19.1-chat-satellites/19.1-SECURITY.md
index b3b4a6fd..2afb8d05 100644
--- a/.planning/phases/19.1-chat-satellites/19.1-SECURITY.md
+++ b/.planning/phases/19.1-chat-satellites/19.1-SECURITY.md
@@ -51,7 +51,7 @@ Implementation lives in the sibling repos `sm-userfriends-plugin`, `sm-forum-plu
 | T-19.1-03 | Elevation of privilege | `sm-chatvideo-plugin/classes/livekit.go` token mint | high | mitigate | `sub` = user id, HS256, `ErrNotConfigured` on empty secret (`livekit.go:49-83`); secret from server config only; mint only after `requireParticipant`; `TestLiveKitTokenClaims` | closed |
 | T-19.1-05 | Elevation of privilege | `sm-chatvideo-plugin/classes/authorizer.go` | high | mitigate | Strict `video:session:{digits}` parse (`authorizer.go:84-103`); participant check (`:54-79`); `prs` capability only; `TestVideoAuthorizer` | closed |
 | T-19.1-09 | Information disclosure | `sm-chatvideo-plugin/api/call_links.go` | medium | mitigate | `call-link` 10/min (`routes.go:38-40,63`); uniform `ErrNotFound` → 404 (`video_service.go:266-282`, `api/errors.go:37-38`) | closed |
-| T-19.1-12 | Information disclosure | `testdata/goldens/` (five plugins) | medium | mitigate | Fixtures verified clean (no VAPID private key, LiveKit secret, JWT or key-shaped strings). The planned grep gate is not in `check-phase19.1.sh`; follow-up adds it with a `--self-test` plant | open — below high threshold (non-blocking) |
+| T-19.1-12 | Information disclosure | `testdata/goldens/` (five plugins) | medium | mitigate | Fixtures verified clean; `check-phase19.1.sh` docs stage runs `detect_secrets` (key names, PEM private keys, JWTs) over each sibling's `testdata/goldens`, refusing on a hit or a missing tree; `--self-test` plants each pattern | closed |
 | T-19.1-SC | Tampering | `go.mod` of five plugins, `scripts/check-phase19.1.sh` | high | mitigate | Only decision-noted pins (webpush-go v1.4.0, livekit server-sdk-go/v2 v2.19.0, bluemonday indirect via framework); userfriends `sm-chat-plugin` require accepted as override in VERIFICATION; gate fail-closed (`check-phase19.1.sh:100-145`) with `--self-test` (`:199-251`) | closed |
 
 *Status: open · closed · open — below high threshold (non-blocking)*
@@ -83,6 +83,7 @@ No accepted risks.
 | Audit Date | Threats Total | Closed | Open | Run By |
 |------------|---------------|--------|------|--------|
 | 2026-10-18 | 13 | 12 | 1 (non-blocking, medium) | msd-security-auditor |
+| 2026-10-18 | 13 | 13 | 0 | orchestrator (T-19.1-12 gate added) |
 
 ---