LiteLLM 1.107.0 cleanup: what a stable security baseline should verify

A host-level cleanup can look finished while an exposed service, cached artifact, or stale credential remains active. LiteLLM's incident guidance calls for removing compromised artifacts from registries, rebuilding affected environments, rotating credentials, and confirming old releases cannot return through caches. External scans, such as ZoomEye queries on the LiteLLM title and default port 4000, show where services are visible, while internal records show which deployments exist, their owners, and the artifacts they run. The two views should be joined at the level of owned assets rather than summed, since one host or owner can appear across several queries. Closure requires verified ownership, confirmation that the compromised release is absent, correct authentication and ingress settings, and, where the payload could have run, credential rotation and a persistence check. Evidence must be timestamped, since earlier clean scans or newly created keys do not by themselves prove the final state.