diff --git a/SCAN-TODO.md b/SCAN-TODO.md
index 9fba03601..9985f60bb 100644
--- a/SCAN-TODO.md
+++ b/SCAN-TODO.md
@@ -12,7 +12,7 @@ Rule: clone, scan, delete clone after. Keep disk under 90%.
 - [x] ClamAV (C, antivirus engine) — clamav-0001 MOAD-0004 CWE-312 proxy password logged verbatim on curl failure; MOAD-0001/0002/0003/0005 CLEAN (AC trie, BM hash, mutex-protected cache)
 - [x] Snort (C++, IDS/IPS) — snort3-0001 MOAD-0001 CWE-407 service_candidates std::find dedup O(M*C) per packet in AppID ServiceDiscovery 72x at M=10000; snort3-0002 MOAD-0001 CWE-407 CHP match_tally std::find_if O(M*T) per HTTP packet 48x at T=100; MOADs 0002/0003/0004/0005 CLEAN
 - [ ] WireGuard (deeper, Go userspace tools)
-- [ ] Thunderbird (C++, email client, undo/history)
+- [x] Thunderbird (C++, email client) — thunderbird-0001 through thunderbird-0006 MOAD-0001 CWE-407 (account dedup 250x, copy-service 250x, IMAP auto-sync 250x, UID-state 500x, filter headers 125x, spam whitelist 100x); thunderbird-0007 MOAD-0001 folder tree init 250x; thunderbird-0008 MOAD-0004 CWE-312 OAuth2 access_token+refresh_token logged verbatim; MOADs 0002/0003/0005 CLEAN
 - [x] Wine (C, Windows compatibility layer) — wine-0002 MOAD-0004 CWE-312 Basic Auth username:password logged verbatim in cache_basic_authorization() TRACE; wine-0003 MOAD-0001 CWE-407 CRYPT_CheckSimpleChainForCycles O(N^2) cert comparison (developer-acknowledged) 47x at N=1000; wine-0004 MOAD-0001 CWE-407 token_find_privilege O(count*P) in AdjustTokenPrivileges/token_check_privileges 143x at N=1000; MOAD-0002/0003/0005 CLEAN
 
 ## Priority 2 — ERP/Business not yet scanned
@@ -36,7 +36,7 @@ Rule: clone, scan, delete clone after. Keep disk under 90%.
 - [ ] Pidgin/Finch (C, chat client)
 - [ ] HexChat (C, IRC client)
 - [ ] Evolution (C, email/calendar)
-- [ ] Thunderbird (C++, email)
+- [x] Thunderbird (C++, email) — see Priority 1 entry above; 8 defects total
 - [ ] Calibre (deeper, Python ebook manager)
 - [ ] Okular/Evince/Zathura (PDF viewers)
 - [ ] OpenSCAD (C++, parametric CAD)
diff --git a/defects/thunderbird-0007/TICKET.md b/defects/thunderbird-0007/TICKET.md
new file mode 100644
index 000000000..90e499dba
--- /dev/null
+++ b/defects/thunderbird-0007/TICKET.md
@@ -0,0 +1,26 @@
+# thunderbird-0007 — about3Pane.js SmartServerPane.initServer() existingURIs O(F^2)
+
+**UNDF:** UNDF-2026-000001168
+**MOAD:** 0001 (CWE-407)
+**Severity:** MEDIUM-HIGH
+**Component:** mail/base/content/about3Pane.js
+
+## Summary
+
+`initServer()` builds `existingURIs` as an Array then calls
+`existingURIs.includes()` inside a do-while loop over `remainingFolderURIs`.
+After each `addFolder()` call our array is fully rebuilt from DOM via
+`Array.from(existingRows, li => li.uri)`. Every `includes()` is O(F) with F
+iterations, producing O(F^2) total.
+
+Measured at O(F^2) for F folders (e.g. 500 IMAP folders = 250,000 ops).
+
+## Fix
+
+Use a `Set<string>` for `existingURIs`. Seed it once from DOM; update it
+directly when `addFolder()` adds a row, eliminating repeated DOM scans.
+
+## Files
+
+- patch/thunderbird-0007_about3Pane_initServer_existingURIs_ON2.patch
+- test/ThunderbirdInitServerTest.java
diff --git a/defects/thunderbird-0008/TICKET.md b/defects/thunderbird-0008/TICKET.md
new file mode 100644
index 000000000..e56e9bdb5
--- /dev/null
+++ b/defects/thunderbird-0008/TICKET.md
@@ -0,0 +1,30 @@
+# thunderbird-0008 — OAuth2.sys.mjs access_token and refresh_token logged verbatim (CWE-312)
+
+**UNDF:** UNDF-2026-000001169
+**MOAD:** 0004 (CWE-312 Logged Secret)
+**Severity:** HIGH
+**Component:** mailnews/base/src/OAuth2.sys.mjs
+
+## Summary
+
+`requestAccessToken()` receives our full JSON response from our OAuth2
+authorization server, serializes it with `JSON.stringify(result)`, then logs
+it verbatim at `log.info` level:
+
+- line 333: `log.info(`Error response details: ${resultStr}`)`
+- line 358: `log.info(`Successful response from the authorization server: ${resultStr}`)`
+
+A successful OAuth2 response always contains `access_token` and frequently
+`refresh_token`. These tokens grant full email account access. Any process
+that reads Thunderbird logs (crash reporters, log aggregators, syslog) receives
+live bearer tokens.
+
+## Fix
+
+Redact `access_token` and `refresh_token` fields before logging. Replace token
+values with `[REDACTED]` in our log output.
+
+## Files
+
+- patch/thunderbird-0008_OAuth2_accessToken_logged_CWE312.patch
+- test/ThunderbirdOAuth2TokenLogTest.java