Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

docs/07_SECURITY/THREAT_MODEL.md

@@ -0,0 +1,37 @@
+# Threat Model
+
+## ModelForge M6 boundary
+
+The ModelForge credential is a mode-0600 read-only mounted file, not environment content. Adapter
+requests contain transient text but logs/metrics contain only provider name, correlation and timing.
+The adapter rejects cloud hosts and has no cloud fallback. Public retrieval cannot select the
+shadow collection; only the operator command may target it.
+
+## Assets
+
+Documentbytes, parsed content, embeddings, queries, answers, credentials, grants, modelroutes, auditlogs en hersteldata.
+
+## Trust boundaries
+
+Internet/LAN client -> reverse proxy -> RAGCore app -> internal services; source connector -> ingestion; RAGCore -> modelprovider; operator -> backupmedia.
+
+## Belangrijkste dreigingen
+
+1. Cross-workspace/space data leakage, inclusief operationele metadata: joblijsten,
+   statustellers, source-namen en foreign job retry (zie Operations isolation in
+   `SECURITY_CONTROLS.md`).
+2. Gestolen service token of sessie.
+3. Prompt injection in documenten.
+4. Data poisoning of kwaadaardige bronupdates.
+5. Path traversal, SSRF, archive bomb en parser exploit.
+6. Onbedoeld versturen van local-only data naar cloudprovider.
+7. Qdrant/DB exposure of filterbypass.
+8. Citation IDOR en historical-content leakage.
+9. Job duplication/race die halfgepubliceerde index veroorzaakt.
+10. Backup met secrets of onverifieerbare restore.
+11. Resource exhaustion via uploads, queries of modelcalls.
+12. Supply-chain of model-update regressie.
+
+## Security acceptance
+
+Voor ieder bedreigingsscenario bestaan preventieve controls, detectie, negatieve tests en een herstel/runbook. Critical/high bevindingen blokkeren milestone release.