sigmashake-docs — Threat Model
STRIDE per surface. Last fully reviewed 2026-05-27.
Surfaces
1. Public HTTP API
Assets. Session cookies, bearer tokens, audit log, persistent state.
| STRIDE | Threat | Mitigation |
|---|---|---|
| Spoofing | Forged session cookie | HMAC-signed cookie; rotation via Secrets Store. |
| Tampering | Modified Authorization header | Bearer is signed JWT; signature checked on every request. |
| Repudiation | Operator denies an action | Every mutating action emits an audit event (per-row Ed25519-signed, tamper-evident per row). |
| Info disclosure | Cross-tenant data leak via dispatcher bug | RBAC at handler boundary + org_id FK on every row. |
| DoS | Compute-heavy admin call | Rate limit per session; expensive endpoints offloaded to background jobs. |
| EoP | Permission escalation via custom role | Permission-escalation check blocks granting a role you don't hold. |
2. Outbound integrations
Assets. Vault credentials, third-party API tokens.
| STRIDE | Threat | Mitigation |
|---|---|---|
| S | Spoofed outbound destination | Pinned TLS fingerprint where applicable. |
| T | Modified request payload | All outbound calls signed where the API supports it. |
| I | Credential exfiltration | Credentials read from Secrets Store at request time; never logged. |
Cross-cutting controls
- Audit log. Mutating operations append to the sigmashake-gov governance audit log, which is per-row Ed25519-signed (each row's signature makes row-content tampering detectable; deletions are tracked by policy, not cryptographically prevented). Merkle / hash-chaining is a separate mechanism used by distinct logs — the sigmashake-compliance evidence pipeline (daily Merkle manifest roots) and the sigmashake-fleet cloud audit log (per-event hash chain,
emitAdminAudit) — and is not used by the governance audit log. - Secrets handling. All credentials live in Cloudflare Secrets Store.
- Dependency hygiene. Nightly
bun auditblocks high/critical CVEs. - Operator MFA. All operator accounts MFA-required.
Findings tracker
| # | Finding | Severity | Status |
|---|---|---|---|
| (initial threat model — no open findings as of 2026-05-27) |
AI-assisted internal security review — 2026-06-18
Reviewer: Claude Opus 4.8 (Anthropic) Date: 2026-06-18 Methodology: White-box, code-level AI-assisted internal security review conducted by Claude Opus 4.8 (Anthropic) with full source-code access, aligned to OWASP WSTG v4.2 and OWASP ASVS v4.0.3. Static source analysis of authn, input validation, SSRF/open-redirect surface, secret handling, response headers, crypto hygiene, and honesty-contract copy. Disclaimer: AI-assisted internal security review (Claude Opus 4.8) — not a third-party penetration test. This review was conducted by an AI system (Claude Opus 4.8, Anthropic) under operator direction with full source-code access on 2026-06-18. It is NOT a third-party human penetration test; no external offensive-security firm and no CPA firm has been engaged. It does not substitute for a human-led engagement by a certified (CREST/OSCP/GPEN) firm. It is appended alongside — and does not replace — the prior Claude Opus 4.7 (2026-05-19) review record.
Confirmed findings (2026-06-18 round)
| ID | File | Line | Title | Severity | Status |
|---|---|---|---|---|---|
| DOCS-2026-0618-01 | docs/security/threat-model.md | 15, 32 | The sigmashake-gov governance audit log was loosely described as "Merkle-chained" — corrected to per-row Ed25519-signed. (The sigmashake-fleet cloud audit log and the sigmashake-compliance / hub transparency log are separately Merkle / hash-chained — distinct logs, correctly labeled on the fleet and CLI pages.) | Medium | Fixed in this document |
| DOCS-2026-0618-02 | docs/security.md | 162 | SOC 2 Type II "targeted for Q4 2026" overstates timeline (observation window ends 2026-11-17; earliest report Q1 2027; no CPA firm engaged) | Medium | Fixed |
| DOCS-2026-0618-03 | docs/customer/security-whitepaper.md | 57 | "SOC 2 Type II (in progress)" lacks readiness/no-CPA-firm qualifier | Low | Fixed |
| DOCS-2026-0618-04 | docs/compliance/iso27001/vulnerability-management-procedure.mdx | 27, 70 | "Annual third-party penetration test" presented as established control; no third-party pentest has been performed | Low | Fixed |
| DOCS-2026-0618-05 | docs/fleet-policies.md | 101 | Dangling reference to docs/security/mdm-agent-update-pentest-2026-05-20.md (file does not exist); mislabeled as "pentest review" | Low | Fixed |
| DOCS-2026-0618-06 | docs/policies/security.md | 11 | "immutable content verification" overclaims; model is tamper-evident (hash/signature detection) | Low | Fixed |
Clean areas (2026-06-18 round)
src/mcp.ts— stdio MCP server is local-only and read-only; no network exposure beyond local filesystem access.