# Threat Model

## ModelForge M6 boundary

The ModelForge credential is a mode-0600 read-only mounted file, not environment content. Adapter
requests contain transient text but logs/metrics contain only provider name, correlation and timing.
The adapter rejects cloud hosts and has no cloud fallback. Public retrieval cannot select the
shadow collection; only the operator command may target it.

## Assets

Documentbytes, parsed content, embeddings, queries, answers, credentials, grants, modelroutes, auditlogs en hersteldata.

## Trust boundaries

Internet/LAN client -> reverse proxy -> RAGCore app -> internal services; source connector -> ingestion; RAGCore -> modelprovider; operator -> backupmedia.

## Belangrijkste dreigingen

1. Cross-workspace/space data leakage, inclusief operationele metadata: joblijsten,
   statustellers, source-namen en foreign job retry (zie Operations isolation in
   `SECURITY_CONTROLS.md`).
2. Gestolen service token of sessie.
3. Prompt injection in documenten.
4. Data poisoning of kwaadaardige bronupdates.
5. Path traversal, SSRF, archive bomb en parser exploit.
6. Onbedoeld versturen van local-only data naar cloudprovider.
7. Qdrant/DB exposure of filterbypass.
8. Citation IDOR en historical-content leakage.
9. Job duplication/race die halfgepubliceerde index veroorzaakt.
10. Backup met secrets of onverifieerbare restore.
11. Resource exhaustion via uploads, queries of modelcalls.
12. Supply-chain of model-update regressie.

## Security acceptance

Voor ieder bedreigingsscenario bestaan preventieve controls, detectie, negatieve tests en een herstel/runbook. Critical/high bevindingen blokkeren milestone release.