# Threat model

## Assets

- User credentials and sessions.
- Wiki and project content.
- Revisions and audit attribution.
- Attachments.
- API service tokens.
- LeafWiki source snapshot.
- Database and backups.
- Data-protection and backup keys.
- Host filesystem and Docker socket.
- Availability and integrity of the Unraid deployment.

## Trust boundaries

1. Browser ↔ reverse proxy.
2. Reverse proxy ↔ application.
3. API client ↔ application.
4. Application ↔ PostgreSQL.
5. Application ↔ writable data volumes.
6. Application ↔ read-only import source.
7. Backup storage.
8. Container ↔ Unraid host.

## Threat register

| ID | Threat | Primary controls | Required verification |
|---|---|---|---|
| T01 | First-run owner registration race | atomic single-use setup; CSRF; setup rate limit | concurrent setup integration test |
| T02 | Password brute force/account enumeration | adaptive hashing; generic errors; lockout; rate limit | auth abuse tests |
| T03 | Session theft/fixation | secure cookie; rotation; bounded life; security stamp | session lifecycle tests |
| T04 | CSRF mutation | same-origin; anti-forgery; SameSite | CSRF integration tests |
| T05 | Horizontal/vertical authorization bypass | application-layer policies; scoped queries | role/object substitution matrix |
| T06 | Search metadata leakage | permission filter before ranking/facets/snippets | rare-term private-page tests |
| T07 | Stored XSS in Markdown/Mermaid | no raw HTML; sanitizer; strict Mermaid; CSP | XSS corpus/browser test |
| T08 | Malicious attachment execution | signature validation; download-only policy; nosniff; authorization | upload/serving corpus |
| T09 | Path traversal/symlink escape | hash paths; normalized bounded import root; no unsafe following | traversal fixture tests |
| T10 | LeafWiki source mutation | RO mount; immutable SQLite; before/after fingerprint | source hash proof |
| T11 | Import overwrite/data loss | preflight; explicit conflicts; provenance; rollback | conflict/idempotency/rollback tests |
| T12 | API token theft/database recovery | random 256-bit secret; verifier only; revoke/expiry; no logs | token lifecycle/log tests |
| T13 | Concurrency overwrite | ETag/If-Match; drafts; conflict UI | concurrent edit E2E |
| T14 | Backup theft/tamper | storage controls; optional authenticated encryption; manifest hashes | corrupt/encrypted backup tests |
| T15 | Restore of incompatible/corrupt data | compatibility checks; clean-target restore; integrity checks | restore matrix |
| T16 | Secret leakage through logs/support bundle | structured redaction; safe exports | secret canary scan |
| T17 | Container-to-host escalation | non-root; read-only root; dropped caps; no Docker socket | image/runtime inspection |
| T18 | SSRF through project links/import metadata | no server fetch of user URLs; bounded local roots | SSRF negative tests |
| T19 | Denial of service via parser/search/upload | size/complexity bounds; timeouts; rate limits; streaming | resource-limit tests |
| T20 | Audit/history tampering through normal app | append-only paths; restricted DB behavior; immutable revisions | mutation/permission tests |
| T21 | Service account scope escalation | explicit scopes plus content auth; no admin bypass | API scope matrix |
| T22 | Outbox/job duplicate side effects | idempotency; leases; attempt state | restart/retry tests |
| T23 | Unsafe database migration | backup; compatibility gates; rehearsal | upgrade/rollback tests |
| T24 | Sensitive content in external image requests | external image hotlink disabled by default | renderer/network tests |

## Abuse cases

### Malicious reader guesses page IDs

Response must not distinguish inaccessible from nonexistent where doing so leaks
existence. Search, attachments, revisions and context use the same resource policy.

### Malicious editor uploads HTML disguised as PNG

The server streams, checks signature and applies detected-type policy. It does not render
the file inline. Filename and declared MIME are not trusted.

### Imported Markdown contains scripts and unsafe URLs

Raw source is preserved for provenance, but normal rendering uses the safe Markdown
profile. Import validation includes renderer security tests.

### Stolen service token

Administrator can identify token prefix/last use and revoke it. Token cannot log into the
browser, exceed scopes or recover the owner password. Mutations remain attributable.

### Compromised app container

The container runs non-root, lacks Docker socket and host-wide mounts, and has a read-only
root filesystem. Database/files remain at risk within granted access; backups and host
security are still required. Do not claim container isolation eliminates this risk.

## Review cadence

- Update when trust boundaries, auth, uploads, imports, backup or deployment change.
- Perform focused review per milestone.
- Perform independent full review in M8.
- Record accepted residual risk through ADR or release notes.