RAGcore-Public/docs/07_SECURITY/THREAT_MODEL.md

Threat Model

ModelForge M6 boundary

The ModelForge credential is a mode-0600 read-only mounted file, not environment content. Adapter requests contain transient text but logs/metrics contain only provider name, correlation and timing. The adapter rejects cloud hosts and has no cloud fallback. Public retrieval cannot select the shadow collection; only the operator command may target it.

Assets

Documentbytes, parsed content, embeddings, queries, answers, credentials, grants, modelroutes, auditlogs en hersteldata.

Trust boundaries

Internet/LAN client -> reverse proxy -> RAGCore app -> internal services; source connector -> ingestion; RAGCore -> modelprovider; operator -> backupmedia.

Belangrijkste dreigingen

1. Cross-workspace/space data leakage, inclusief operationele metadata: joblijsten, statustellers, source-namen en foreign job retry (zie Operations isolation in SECURITY_CONTROLS.md).
2. Gestolen service token of sessie.
3. Prompt injection in documenten.
4. Data poisoning of kwaadaardige bronupdates.
5. Path traversal, SSRF, archive bomb en parser exploit.
6. Onbedoeld versturen van local-only data naar cloudprovider.
7. Qdrant/DB exposure of filterbypass.
8. Citation IDOR en historical-content leakage.
9. Job duplication/race die halfgepubliceerde index veroorzaakt.
10. Backup met secrets of onverifieerbare restore.
11. Resource exhaustion via uploads, queries of modelcalls.
12. Supply-chain of model-update regressie.

Security acceptance

Voor ieder bedreigingsscenario bestaan preventieve controls, detectie, negatieve tests en een herstel/runbook. Critical/high bevindingen blokkeren milestone release.