Purpose: state who/what we defend against (complements SECURITY_POLICY.md, which states what’s allowed). Lightweight STRIDE-flavored pass; refined as the system grows.
1. Assets
- Profile contents (cookies, sessions, wallets) — highest value.
- Vault secrets (proxy creds, tokens, automation secrets).
- User credentials / license tokens.
- Action log integrity (for teams/compliance).
- The patched core build pipeline integrity (Phase 7+).
2. Actors we defend against
| Actor | Concern |
|---|---|
| Remote network attacker | intercepts sync traffic, tampers blobs |
| Malicious/curious cloud insider | tries to read profile contents |
| Local malware / other user on device | reads profile dirs, vault, local API |
| Malicious npm module in automation | exfiltrates secrets/data |
| Account sharer / license abuser | bypasses plan limits |
| Compromised dependency / build | ships a backdoored app or core |
3. Defenses (mapped)
| Threat (STRIDE) | Defense |
|---|---|
| Spoofing | per-session local API token; auth + device binding; signed artifacts |
| Tampering | AEAD + Ed25519 sig on blobs; append-only audit; TLS; core signature verify |
| Repudiation | Action Log per actor with mode + result |
| Info disclosure | zero-knowledge client-side encryption; server stores ciphertext only; loopback API; secret redaction |
| Denial of service | rate limits/quotas (cloud); local ops degrade gracefully offline |
| Elevation | policy modes + re-auth for danger; least-privilege Node sidecar; module-boundary enforcement |
4. Explicit residual risks (accepted/with mitigations)
- Loss of ALL key factors → data loss (zero-knowledge tradeoff). Mitigation (ADR-0008 multi-KEK): mandatory Recovery Key + optional passkey / OS-keychain / team org-KEK recovery; clear UX warnings.
- Local device fully compromised → live profiles readable. Out of scope to fully prevent;
mitigate with at-rest encryption, OS keychain for the master key when idle, secure-wipe of the
materialized dir on pack/evict, and keeping the materialized (plaintext) window minimal
(PROFILE_STORAGE_SYNC §6).
materializenever hands a raw path to remote clients. - Detectability ceiling of the temporary core (Phase 1-2) → documented, trust-scored, not hidden.
5. Out of scope (for now)
- Nation-state local persistence; hardware attacks; defending a rooted/compromised OS beyond best-effort.
Open questions
OS keychain integration for idle master key, npm sidecar sandbox tech (separate user/container?), blob residency/compliance → OPEN_QUESTIONS.md.