docs(p0): compact MVP spec for Android Oboe focus
This commit is contained in:
Edison Jwa
@@ -1,126 +0,0 @@
|
||||
# Sec Dependency And Supply Chain Report V0.9.2.2.1
|
||||
|
||||
**Document type:** Security / Dependency and Supply Chain Report
|
||||
**Version:** 0.9.2
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/dependency-and-supply-chain-report.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This report records Chanora dependency inventory, license review, vulnerability review, SBOM status, and supply-chain release readiness.
|
||||
|
||||
## 2. Dependency Scope
|
||||
|
||||
| Ecosystem | In scope |
|
||||
|---|---|
|
||||
| Flutter / Dart | `pubspec.yaml`, transitive packages, Flutter SDK version |
|
||||
| Rust | `Cargo.toml`, `Cargo.lock`, crates, features |
|
||||
| Protocol library | `tsclientlib` and related crates/dependencies |
|
||||
| Native audio | Platform audio libraries, native build dependencies, bindings |
|
||||
| Build tooling | CI actions, build scripts, code generators |
|
||||
| Packaging | Platform packaging tools and signing tools |
|
||||
|
||||
## 3. Required Outputs
|
||||
|
||||
| Output | Required before external release |
|
||||
|---|---|
|
||||
| Dependency inventory | Yes |
|
||||
| License report | Yes |
|
||||
| Vulnerability scan report | Yes |
|
||||
| SBOM | Yes |
|
||||
| Critical/high vulnerability disposition | Yes |
|
||||
| Unknown license disposition | Yes |
|
||||
| Build provenance record | Yes |
|
||||
| Artifact hash record | Yes |
|
||||
|
||||
## 4. Dependency Inventory
|
||||
|
||||
| Component | Ecosystem | Version | License | Source | Risk | Notes |
|
||||
|---|---|---|---|---|---|---|
|
||||
| Flutter SDK | Flutter | TBD | TBD | TBD | TBD | TBD |
|
||||
| Dart packages | Dart | TBD | TBD | TBD | TBD | TBD |
|
||||
| Rust toolchain | Rust | TBD | TBD | TBD | TBD | TBD |
|
||||
| Rust crates | Rust | TBD | TBD | TBD | TBD | TBD |
|
||||
| `tsclientlib` | Rust/protocol | TBD | TBD | TBD | TBD | TBD |
|
||||
| Native audio dependencies | Native | TBD | TBD | TBD | TBD | TBD |
|
||||
| CI actions/tools | Build | TBD | TBD | TBD | TBD | TBD |
|
||||
|
||||
## 5. License Review
|
||||
|
||||
| License category | Policy |
|
||||
|---|---|
|
||||
| Permissive licenses | Generally acceptable after review |
|
||||
| Copyleft licenses | Requires legal review before release |
|
||||
| Unknown licenses | Release blocker until resolved |
|
||||
| Proprietary dependencies | Requires explicit approval |
|
||||
| Incompatible licenses | Release blocker unless removed or legal waiver approved |
|
||||
|
||||
## 6. Vulnerability Review
|
||||
|
||||
| Finding ID | Dependency | Severity | CVE / advisory | Status | Disposition |
|
||||
|---|---|---|---|---|---|
|
||||
| TBD | TBD | TBD | TBD | TBD | TBD |
|
||||
|
||||
## 7. SBOM
|
||||
|
||||
| Field | Value |
|
||||
|---|---|
|
||||
| SBOM format | TBD: SPDX / CycloneDX / other |
|
||||
| SBOM tool | TBD |
|
||||
| SBOM file | TBD |
|
||||
| SBOM generation date | TBD |
|
||||
| SBOM reviewer | TBD |
|
||||
|
||||
## 8. Build Provenance
|
||||
|
||||
| Field | Value |
|
||||
|---|---|
|
||||
| Git commit SHA | TBD |
|
||||
| Git tag | TBD |
|
||||
| CI pipeline ID | TBD |
|
||||
| Build environment | TBD |
|
||||
| Artifact hashes | TBD |
|
||||
| Signing identity | TBD |
|
||||
| Reproducibility status | TBD |
|
||||
|
||||
## 9. Release Gate
|
||||
|
||||
| Gate | Required result |
|
||||
|---|---|
|
||||
| Critical vulnerabilities | None open without approved waiver |
|
||||
| High vulnerabilities | None open without approved waiver |
|
||||
| Unknown licenses | None open without approved waiver |
|
||||
| SBOM | Generated and archived |
|
||||
| License report | Reviewed |
|
||||
| Dependency report | Approved |
|
||||
|
||||
## 10. Approval
|
||||
|
||||
| Role | Name | Decision | Date |
|
||||
|---|---|---|---|
|
||||
| Security Reviewer | TBD | Pending | TBD |
|
||||
| Legal Reviewer | TBD | Pending | TBD |
|
||||
| Engineering Owner | TBD | Pending | TBD |
|
||||
| Release Manager | TBD | Pending | TBD |
|
||||
|
||||
## 11. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial dependency and supply-chain report template. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
@@ -1,134 +0,0 @@
|
||||
# Sec Diagnostic Redaction Audit Report V0.9.3.0.0
|
||||
|
||||
**Document type:** Security / Diagnostic Redaction Audit Report
|
||||
**Version:** 0.9.3
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/diagnostic-redaction-audit-report.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This report records evidence that Chanora logs and diagnostic exports do not leak sensitive information.
|
||||
|
||||
## 2. Sensitive Data Redaction Policy
|
||||
|
||||
| Data category | Default diagnostic behavior |
|
||||
|---|---|
|
||||
| Server password | Must redact |
|
||||
| Identity private key / identity secret | Must redact |
|
||||
| Authentication tokens if later added | Must redact |
|
||||
| Secure-storage keys | Must redact |
|
||||
| Server address | Redact or minimize according to release policy |
|
||||
| Channel names | Redact or include only with explicit user consent |
|
||||
| Client nicknames | Redact or include only with explicit user consent |
|
||||
| Chat messages | Exclude by default unless a future explicit opt-in policy is approved |
|
||||
| Local file paths | Minimize or redact user-identifying segments |
|
||||
| Device IDs | Redact or hash if collected |
|
||||
| IP addresses | Redact or minimize according to release policy |
|
||||
|
||||
## 3. Diagnostic Surfaces
|
||||
|
||||
| Surface | Risk | Required control |
|
||||
|---|---|---|
|
||||
| Application log | Secret leakage | Redaction filter and structured logging discipline |
|
||||
| Protocol log | Hostile or sensitive server content | Redaction and length limits |
|
||||
| Audio diagnostics | Device privacy | Device name minimization if needed |
|
||||
| Export bundle | Aggregated sensitive data | Redaction audit before release |
|
||||
| Error report | Stack trace or secret context | User-safe error mapping |
|
||||
| User support copy/paste | Over-sharing | Explicit review and confirmation |
|
||||
|
||||
## 4. Redaction Test Matrix
|
||||
|
||||
| Test ID | Input | Expected output | Status | Evidence |
|
||||
|---|---|---|---|---|
|
||||
| REDACT-TC-001 | Server password in connection data | Password replaced by `[REDACTED]` | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_001_server_password_in_connection_data` |
|
||||
| REDACT-TC-002 | Identity secret in storage error | Secret absent | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_002_identity_secret_in_storage_error` (via `KnownSecretRegistry`) |
|
||||
| REDACT-TC-003 | Server URL with password-like field | Secret part redacted | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_003_server_url_with_password_field` — only the password value is redacted, the host and other query params keep flowing |
|
||||
| REDACT-TC-004 | Chat text in diagnostic export | Excluded by default | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_004_chat_text_excluded_by_default` — default policy sets `include_chat = false` |
|
||||
| REDACT-TC-005 | Channel name with Unicode | Preserved only if permitted; otherwise redacted safely | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_005_channel_name_with_unicode_excluded_by_default` — default policy excludes; UTF-8 preservation verified in TC-010 |
|
||||
| REDACT-TC-006 | Nickname with Unicode | Preserved only if permitted; otherwise redacted safely | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_006_nickname_with_unicode_preserved_in_safe_field` |
|
||||
| REDACT-TC-007 | Local file path | User-identifying segments redacted or minimized | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_007_local_file_paths_user_segment_minimized` — Linux `/home/<user>/`, Windows `C:\Users\<user>\`, macOS `/Users/<user>/` all minimized |
|
||||
| REDACT-TC-008 | Diagnostic bundle with mixed sensitive fields | All sensitive fields redacted | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields` — whole-bundle JSON scan finds no plaintext |
|
||||
| REDACT-TC-009 | Long hostile protocol string | Truncated or safely escaped | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_009_long_hostile_protocol_string_truncated` — `MAX_PROTOCOL_STRING_LEN = 256` cap with `…[truncated]` marker |
|
||||
| REDACT-TC-010 | Multilingual safe diagnostic text | Unicode preserved | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_010_multilingual_safe_text_preserved` — Chinese, Japanese, Korean, and Latin-diacritic text preserved verbatim |
|
||||
|
||||
## 5. Export Bundle Contents
|
||||
|
||||
| Bundle item | Included? | Redaction rule | Status |
|
||||
|---|---|---|---|
|
||||
| App version | Yes | None | PoC Pass (`DiagnosticBundle.app_version` preserved verbatim) |
|
||||
| Build number | Yes | None | PoC Pass (`DiagnosticBundle.build_number` preserved verbatim) |
|
||||
| Platform info | Yes | Minimize device details | PoC Pass — flows through `Redactor::redact_text`, so embedded paths/usernames are minimized |
|
||||
| Connection state | Yes | No secrets | PoC Pass — flows through `Redactor::redact_text` |
|
||||
| Server address | Yes (redacted) | Redact/minimize | PoC Pass — passwords inside `ts3server://` URLs redacted |
|
||||
| Channel tree | No by default | Redact/minimize | PoC Pass — default `include_channel_tree = false` |
|
||||
| Chat history | No by default | Exclude unless explicit policy changes | PoC Pass — default `include_chat = false` |
|
||||
| Logs | Yes | Redacted | PoC Pass — each log line flows through `Redactor::redact_text` |
|
||||
| Audio diagnostics | Yes | No audio content | PoC Pass — only device names are exported; no PCM |
|
||||
| Secure storage data | No | Never include | PoC Pass by construction — the redactor has no path that reads from `SecretStorageRepository`; the host application must never put secret material into the bundle in the first place |
|
||||
|
||||
## 6. Findings
|
||||
|
||||
| Finding ID | Severity | Description | Status | Owner |
|
||||
|---|---|---|---|---|
|
||||
| REDACT-FIND-001 | Informational | The PoC regex catalogue covers the documented audit matrix but is not exhaustive. Production `chanora_diagnostics` should add fuzz testing and adversarial inputs (e.g. base64 lookalikes, unicode confusables, regex evasion). | Open | Security Reviewer + `chanora_diagnostics` owner |
|
||||
| REDACT-FIND-002 | Informational | The PoC redactor is a post-processor over strings. Production code should wire the redactor as a `tracing-subscriber` layer so redaction happens at write-time, not by re-walking text afterward. | Open — to be addressed when `chanora_diagnostics` is scaffolded | `chanora_diagnostics` owner |
|
||||
| REDACT-FIND-003 | Informational | The `KnownSecretRegistry` defence-in-depth requires the secure-storage layer to register secrets when they materialise. The cross-spike contract is documented but not yet enforced by any product code. | Open — to be enforced by `chanora_storage` calling into `chanora_diagnostics`. | `chanora_storage` + `chanora_diagnostics` owners |
|
||||
|
||||
## 7. Approval
|
||||
|
||||
| Role | Name | Decision | Date |
|
||||
|---|---|---|---|
|
||||
| Security Reviewer | TBD | Pending | TBD |
|
||||
| Privacy Reviewer | TBD | Pending | TBD |
|
||||
| QA / Verification Owner | TBD | Pending | TBD |
|
||||
|
||||
## 8. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial diagnostic redaction audit report template. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-14 | Recorded PoC empirical evidence: REDACT-TC-001..010 status set to PoC Pass with evidence pointers to `poc/diagnostics-redaction-spike/tests/redaction.rs`. Export bundle policy §5 populated for every row. Findings REDACT-FIND-001..003 added (regex coverage limits, tracing-layer integration gap, KnownSecretRegistry cross-spike contract). |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Redaction Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
Per SysRS-302 / SRS-202 / SAD-077 / SDD-090, the redaction policy adds the following rules for desktop PTT diagnostics:
|
||||
|
||||
| Rule | Banned field name | Disposition |
|
||||
|---|---|---|
|
||||
| REDACT-PTT-001 | `key_code` | Drop record. |
|
||||
| REDACT-PTT-002 | `scan_code` | Drop record. |
|
||||
| REDACT-PTT-003 | `virtual_key`, `vk` | Drop record. |
|
||||
| REDACT-PTT-004 | `keysym`, `keysym_string` | Drop record. |
|
||||
| REDACT-PTT-005 | `key_sequence`, `key_press_history`, `key_timing` | Drop record. |
|
||||
| REDACT-PTT-006 | Free-form `message` strings shall not embed key values; offending records shall be reformatted by the originating backend before emission. | Drop record. |
|
||||
|
||||
The `PttSanitizer` `tracing_subscriber::Layer` decorates `RedactingLogLayer` and is the enforcement point. Fields whose names match the banned list cause the entire record to be dropped — Chanora does not attempt to redact-in-place because partial-redaction false negatives are riskier than a missing line.
|
||||
|
||||
Permitted fields for PTT diagnostics: `capability_level`, `backend_id`, `bound_input_class`, `fallback_exercised`.
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT redaction rules REDACT-PTT-001..006: ban raw key codes, scan codes, virtual-key values, keysyms, and key timing sequences from logs and exports. |
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -1,97 +0,0 @@
|
||||
# Sec Secure Storage Audit Report V0.9.3.0.0
|
||||
|
||||
**Document type:** Security / Secure Storage Audit Report
|
||||
**Version:** 0.9.3
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/secure-storage-audit-report.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This report records evidence that Chanora stores secrets using platform secure storage mechanisms and does not store sensitive secrets in plaintext local storage.
|
||||
|
||||
## 2. Secret Classification
|
||||
|
||||
| Secret ID | Secret | Required storage |
|
||||
|---|---|---|
|
||||
| SEC-STORE-001 | Identity private key / identity secret | Platform secure storage |
|
||||
| SEC-STORE-002 | Server password | Platform secure storage |
|
||||
| SEC-STORE-003 | Authentication tokens if later added | Platform secure storage |
|
||||
| SEC-STORE-004 | Encryption keys if later added | Platform secure storage |
|
||||
|
||||
## 3. Platform Audit Matrix
|
||||
|
||||
| Platform | Secure storage mechanism | Test status | Evidence | Result |
|
||||
|---|---|---|---|---|
|
||||
| Windows | DPAPI / Windows Credential Manager (per DEC-013 / SysRS-158) — adapter not yet implemented | Not started | n/a | Deferred to product `chanora_storage` |
|
||||
| macOS | Keychain (per SysRS-159) — adapter not yet implemented | Not started | n/a | Deferred to product `chanora_storage` |
|
||||
| Linux | Secret Service (libsecret) preferred; kernel keyutils fallback per DEC-013.2 | PoC Pass | `poc/secure-storage-spike/VERIFICATION.md`; six audit tests PASS via keyutils backend; CLI run additionally observed Secret-Service-locked → keyutils fallback live | PoC PASS; product audit pending |
|
||||
| Android | Android Keystore (per SysRS-161) — adapter not yet implemented | Not started | n/a | Deferred to product `chanora_storage` |
|
||||
| iOS | Keychain (per SysRS-160) — adapter not yet implemented | Not started | n/a | Deferred to product `chanora_storage` |
|
||||
|
||||
## 4. Audit Checks
|
||||
|
||||
| Check ID | Check | Expected result | Status | Evidence |
|
||||
|---|---|---|---|---|
|
||||
| SS-AUD-001 | Identity secret is not stored in local DB. | Pass | PoC Pass (Linux) | `poc/secure-storage-spike/tests/audit.rs::ss_aud_001_identity_secret_absent_from_local_db` — raw SQLite file scanned for plaintext markers; only the lookup name appears. |
|
||||
| SS-AUD-002 | Server password is not stored in local DB. | Pass | PoC Pass (Linux) | `poc/secure-storage-spike/tests/audit.rs::ss_aud_002_server_password_absent_from_local_db` — distinct plaintext marker scan. |
|
||||
| SS-AUD-003 | Secret values are not written to application logs. | Pass | PoC Pass (Linux) + cross-spike | `poc/secure-storage-spike/tests/audit.rs::ss_aud_003_secret_values_not_in_logs` — captured `tracing` output contains `<redacted>` markers; never the plaintext. Cross-referenced by `poc/diagnostics-redaction-spike` REDACT-TC-002. |
|
||||
| SS-AUD-004 | Secret values are not included in diagnostic export. | Pass | PoC Pass | Covered by `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields` — whole-bundle JSON scan finds no plaintext. |
|
||||
| SS-AUD-005 | Secure storage failure returns safe error. | Pass | PoC Pass (Linux) | `poc/secure-storage-spike/tests/audit.rs::ss_aud_005_safe_error_on_missing_entry`. Reinforced by the CLI driver run: a real locked gnome-keyring collection produced a typed `Backend` error containing no secret material, which the application then routed to the fallback adapter (DEC-013.2). |
|
||||
| SS-AUD-006 | Secret deletion removes secure-storage entry. | Pass | PoC Pass (Linux) | `poc/secure-storage-spike/tests/audit.rs::ss_aud_006_delete_removes_entry` — second delete returns `NotFound`, not silent success. |
|
||||
| SS-AUD-007 | Platform-specific secure storage is documented. | Pass | Partial | Linux documented in `poc/secure-storage-spike/README.md` and DEC-013.2. Windows/macOS/Android/iOS remain to be documented when adapters land in `chanora_storage`. |
|
||||
| SS-AUD-008 | Migration or import path does not expose secrets. | Pass | Pending | No migration / import path exists yet; depends on product `chanora_storage` schema design (cross-references DEC-013.1 and `poc/sqlite-storage-spike`). |
|
||||
|
||||
## 5. Test Cases
|
||||
|
||||
| Test ID | Platform | Procedure | Expected result | Actual result | Status |
|
||||
|---|---|---|---|---|---|
|
||||
| SS-TC-001 | Windows | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | Not run — Windows adapter not implemented in PoC | Deferred |
|
||||
| SS-TC-002 | macOS | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | Not run — macOS adapter not implemented in PoC | Deferred |
|
||||
| SS-TC-003 | Linux | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | Set / get / delete round-trip verified via keyutils backend; raw SQLite file scan confirmed plaintext absence; `tracing` log capture confirmed log absence. | **PoC Pass** |
|
||||
| SS-TC-004 | Android | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | Not run — Android adapter not implemented in PoC | Deferred |
|
||||
| SS-TC-005 | iOS | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | Not run — iOS adapter not implemented in PoC | Deferred |
|
||||
|
||||
## 6. Findings
|
||||
|
||||
| Finding ID | Severity | Description | Status | Owner |
|
||||
|---|---|---|---|---|
|
||||
| SS-FIND-001 | Informational | SysRS-053 / SysRS-162 ("Secret Service, libsecret, or equivalent") admitted both Secret Service and kernel keyutils as Linux backends. The PoC surfaced this ambiguity. | Resolved by DEC-013.2 on 2026-05-13 (Secret Service preferred, keyutils fallback). | Software Architect + Security Reviewer |
|
||||
| SS-FIND-002 | Informational | Kernel keyutils requires a valid session keyring; cargo-test under non-interactive shells inherits an expired `_ses` and must be wrapped with `keyctl session -`. Production code on a graphical session inherits a valid session from PAM. | Documented in `poc/secure-storage-spike/README.md` and `VERIFICATION.md`. | Software Architect |
|
||||
| SS-FIND-003 | Open | Windows / macOS / iOS / Android adapters not implemented; SS-TC-001/002/004/005 unverified. | Open — to be closed by per-platform adapter spikes or by the product `chanora_storage` implementation. | Platform Owners |
|
||||
|
||||
## 7. Approval
|
||||
|
||||
| Role | Name | Decision | Date |
|
||||
|---|---|---|---|
|
||||
| Security Reviewer | TBD | Pending | TBD |
|
||||
| Platform Owner | TBD | Pending | TBD |
|
||||
| QA / Verification Owner | TBD | Pending | TBD |
|
||||
|
||||
## 8. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial secure storage audit report template. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.3 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-14 | Recorded PoC empirical evidence: SS-AUD-001/002/003/005/006 status set to PoC Pass with evidence pointers; SS-AUD-004 cross-referenced to the diagnostics-redaction PoC; SS-TC-003 Linux Actual Result populated and Status set to PoC Pass. Added findings SS-FIND-001 (closed by DEC-013.2), SS-FIND-002 (keyutils session caveat), SS-FIND-003 (non-Linux adapters still open). Non-Linux test cases SS-TC-001/002/004/005 remain Deferred. |
|
||||
@@ -1,89 +0,0 @@
|
||||
# Sec Security Privacy Legal Guideline V0.9.2.2.1
|
||||
|
||||
**Document type:** Security / Privacy / Legal Guideline
|
||||
**Version:** 0.9.2
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/security-privacy-legal-guideline.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This guideline defines the required security, privacy, and legal review documents that must be completed before Chanora is released outside a controlled internal engineering environment.
|
||||
|
||||
A public or external release shall not rely only on SysRS, SysDes, SRS, SAD, SDD, and verification documents. It also requires security, privacy, dependency, and legal evidence.
|
||||
|
||||
## 2. Required Pre-Release Documents
|
||||
|
||||
| Document | Required before | Purpose |
|
||||
|---|---|---|
|
||||
| `docs/security/threat-model.md` | External Beta or public release | Identify attack surfaces, assets, trust boundaries, threats, and mitigations. |
|
||||
| `docs/security/secure-storage-audit-report.md` | Any release storing secrets | Prove platform secure storage behavior. |
|
||||
| `docs/security/diagnostic-redaction-audit-report.md` | Any release with diagnostics export/logs | Prove diagnostics and logs do not leak sensitive information. |
|
||||
| `docs/security/dependency-and-supply-chain-report.md` | Any external release | Prove dependency inventory, licenses, vulnerability status, and SBOM readiness. |
|
||||
| `docs/privacy/privacy-policy.md` | Any public or store release | Explain data handling, local storage, permissions, diagnostics, and upload behavior. |
|
||||
| `docs/legal/trademark-and-attribution-review.md` | Any public or store release | Confirm non-affiliation wording, OSS attribution, and trademark risk review. |
|
||||
|
||||
## 3. Release Gate Rule
|
||||
|
||||
| Release type | Required security/privacy/legal gate |
|
||||
|---|---|
|
||||
| Internal Alpha | Security and privacy draft checklist acceptable if not publicly distributed. |
|
||||
| External Beta | Threat model, secure storage audit, diagnostic redaction audit, dependency report, privacy draft, legal review draft required. |
|
||||
| MVP Public | All listed documents must be completed and approved. |
|
||||
| Store Release | All listed documents must be completed, approved, and aligned with store metadata. |
|
||||
|
||||
## 4. Security Review Principles
|
||||
|
||||
| Principle | Required behavior |
|
||||
|---|---|
|
||||
| Secret minimization | Store only secrets needed for user-approved functionality. |
|
||||
| Local-first diagnostics | Diagnostic export requires explicit user action unless a future policy says otherwise. |
|
||||
| Redaction by default | Secrets and sensitive server/user data are redacted before export. |
|
||||
| Boundary validation | Protocol, platform, and file boundaries validate or sanitize external input. |
|
||||
| Least privilege | Platform permissions are requested only when needed and explained to users. |
|
||||
| Dependency accountability | Flutter packages, Rust crates, native libraries, and protocol libraries are inventoried. |
|
||||
| Release evidence | Security and privacy claims require evidence, not only design intent. |
|
||||
|
||||
## 5. Required Product Owner Decisions
|
||||
|
||||
| Decision | Owner |
|
||||
|---|---|
|
||||
| Whether diagnostics are local-only or upload-capable | Product Owner + Legal |
|
||||
| Whether crash reporting is included | Product Owner + Legal + Security |
|
||||
| Which release channels are used | Product Owner |
|
||||
| Public wording for non-affiliation statement | Legal / Compliance |
|
||||
| Whether any telemetry is collected | Product Owner + Legal |
|
||||
| Minimum supported platforms for secure storage audit | Product Owner + Engineering |
|
||||
|
||||
## 6. Required Engineering Evidence
|
||||
|
||||
| Evidence | Owner |
|
||||
|---|---|
|
||||
| Secure storage test results per platform | Platform / Security |
|
||||
| Diagnostic redaction test results | Security / QA |
|
||||
| Dependency inventory and license output | Engineering / Legal |
|
||||
| SBOM output | Engineering / Security |
|
||||
| Vulnerability scan result | Security / Engineering |
|
||||
| Permission list and justification | Platform / Product |
|
||||
| Threat model review result | Security / Architecture |
|
||||
|
||||
## 7. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial security, privacy, and legal pre-release guideline. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
@@ -1,154 +0,0 @@
|
||||
# Sec Threat Model V0.9.2.2.1
|
||||
|
||||
**Document type:** Security / Threat Model
|
||||
**Version:** 0.9.2
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/threat-model.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This document identifies Chanora security assets, trust boundaries, attack surfaces, threat scenarios, mitigations, and residual risks.
|
||||
|
||||
This document must be completed and approved before public or external release.
|
||||
|
||||
## 2. Security Scope
|
||||
|
||||
In scope:
|
||||
|
||||
- Identity private keys and identity material
|
||||
- Server passwords
|
||||
- Saved bookmarks and recent server entries
|
||||
- Local database
|
||||
- Secure storage
|
||||
- Diagnostic logs and export bundles
|
||||
- Protocol input from compatible servers
|
||||
- Text messages, channel names, server names, and nicknames
|
||||
- Audio device access and microphone permission
|
||||
- Platform permission flows
|
||||
- Dependency and supply-chain risks
|
||||
- Flutter/Rust bridge boundary
|
||||
- Local file export/import surfaces
|
||||
|
||||
Out of scope unless later added:
|
||||
|
||||
- Cloud account sync
|
||||
- Server hosting infrastructure operated by Chanora
|
||||
- Telemetry backend
|
||||
- Crash reporting backend
|
||||
- Payment processing
|
||||
|
||||
## 3. Assets
|
||||
|
||||
| Asset ID | Asset | Sensitivity | Required protection |
|
||||
|---|---|---|---|
|
||||
| SEC-ASSET-001 | Identity private key / identity secret | Critical | Store only in platform secure storage; never log. |
|
||||
| SEC-ASSET-002 | Server password | Critical | Store only in platform secure storage; redact from diagnostics. |
|
||||
| SEC-ASSET-003 | Server address / bookmark | Sensitive | Store locally; redact or minimize in diagnostic export. |
|
||||
| SEC-ASSET-004 | Nickname / user identity display name | Personal / user-provided | Preserve Unicode; avoid unnecessary upload. |
|
||||
| SEC-ASSET-005 | Channel names and server names | Potentially sensitive | Treat as user/server content; redact where configured. |
|
||||
| SEC-ASSET-006 | Chat text | Sensitive user/server content | Do not upload automatically; redact from diagnostics by default unless user explicitly includes. |
|
||||
| SEC-ASSET-007 | Diagnostic bundle | Sensitive aggregate | Redact secrets; user-initiated export only. |
|
||||
| SEC-ASSET-008 | Local database | Sensitive | Protect via OS file permissions; avoid plaintext secrets. |
|
||||
| SEC-ASSET-009 | Logs | Sensitive | Redact secrets and avoid verbose sensitive content. |
|
||||
| SEC-ASSET-010 | Audio stream | Sensitive real-time data | Do not persist audio unless explicitly designed later. |
|
||||
| SEC-ASSET-011 | Dependency graph | Supply-chain-sensitive | Track licenses, vulnerabilities, and source integrity. |
|
||||
|
||||
## 4. Trust Boundaries
|
||||
|
||||
| Boundary ID | Boundary | Risk |
|
||||
|---|---|---|
|
||||
| TB-001 | User input to Flutter UI | Malformed or hostile input. |
|
||||
| TB-002 | Flutter to Rust bridge | DTO validation and error mapping required. |
|
||||
| TB-003 | Rust Core to protocol adapter | Protocol events and external inputs must be normalized. |
|
||||
| TB-004 | Protocol adapter to external compatible server | Untrusted network/server input. |
|
||||
| TB-005 | Rust/Flutter to platform secure storage | Platform-specific failure modes. |
|
||||
| TB-006 | App to local database/file system | File tampering, data leakage, permissions. |
|
||||
| TB-007 | Diagnostics export to user-controlled destination | Sensitive data leakage. |
|
||||
| TB-008 | Audio device boundary | Permission and device-route privacy. |
|
||||
| TB-009 | Dependency supply chain | Vulnerable or malicious dependencies. |
|
||||
|
||||
## 5. Attack Surfaces
|
||||
|
||||
| Surface ID | Attack surface | Example threats |
|
||||
|---|---|---|
|
||||
| AS-001 | Connection form | Credential capture in logs, malformed host input. |
|
||||
| AS-002 | Protocol input | Malformed packets, hostile names/messages, state desync. |
|
||||
| AS-003 | Bridge DTOs | Invalid commands, unexpected event payloads. |
|
||||
| AS-004 | Local database | Tampering, unauthorized read. |
|
||||
| AS-005 | Secure storage | Platform fallback failure or incorrect secret classification. |
|
||||
| AS-006 | Diagnostics export | Secret leakage, excessive server/user information. |
|
||||
| AS-007 | Logs | Password or identity leakage. |
|
||||
| AS-008 | Audio permissions | Unclear microphone use or unintended capture. |
|
||||
| AS-009 | Dependency ecosystem | Vulnerable packages or license incompatibility. |
|
||||
| AS-010 | Store/package distribution | Tampered artifacts or signing issues. |
|
||||
|
||||
## 6. Threat Scenarios and Mitigations
|
||||
|
||||
| Threat ID | Scenario | Impact | Mitigation | Verification |
|
||||
|---|---|---|---|---|
|
||||
| THR-001 | Server password is logged during connection failure. | Credential leakage. | Redaction filters; never log secret fields. | Diagnostic redaction audit. |
|
||||
| THR-002 | Identity private key is stored in local DB. | Identity compromise. | Secure storage classification and audit. | Secure storage audit. |
|
||||
| THR-003 | Diagnostic export includes server password or identity secret. | Credential leakage. | Export redaction and denylist/allowlist design. | Redaction audit. |
|
||||
| THR-004 | Hostile server sends malformed Unicode or extremely long names. | Crash, UI corruption, log injection. | Boundary validation, length limits, safe rendering. | Protocol fuzz/sanitization tests. |
|
||||
| THR-005 | Protocol event causes inconsistent UI state. | Wrong user/channel state. | State reducer validation and snapshot recovery. | SWE.5/SWE.6 tests. |
|
||||
| THR-006 | Dependency has known critical vulnerability. | Compromise or exploit risk. | Dependency scan and release gate. | Supply-chain report. |
|
||||
| THR-007 | OSS license is incompatible with release model. | Legal/compliance risk. | License inventory and legal review. | Dependency/license report. |
|
||||
| THR-008 | Microphone permission is unclear to user. | Privacy risk. | Permission explanation and privacy policy. | Privacy/legal review. |
|
||||
| THR-009 | Logs contain private channel or nickname data by default. | Privacy leakage. | Minimize logs; redact or hash sensitive content. | Diagnostics audit. |
|
||||
| THR-010 | Build artifact is not traceable to commit. | Supply-chain/release integrity risk. | Release record with commit, tag, build number, hashes. | Go/No-Go record. |
|
||||
|
||||
## 7. Residual Risks
|
||||
|
||||
| Risk ID | Risk | Disposition |
|
||||
|---|---|---|
|
||||
| RISK-001 | External compatible servers may expose untrusted content. | Accept with boundary validation and safe rendering. |
|
||||
| RISK-002 | Platform secure storage behavior differs by OS/version. | Mitigate with per-platform audit. |
|
||||
| RISK-003 | Dependency vulnerabilities may appear after release. | Mitigate with recurring scan and patch policy. |
|
||||
| RISK-004 | Diagnostic bundles may contain contextual sensitive data even after redaction. | Mitigate with user confirmation and privacy notice. |
|
||||
|
||||
## 8. Approval
|
||||
|
||||
| Role | Name | Decision | Date |
|
||||
|---|---|---|---|
|
||||
| Security Reviewer | TBD | Pending | TBD |
|
||||
| Software Architect | TBD | Pending | TBD |
|
||||
| Platform Owner | TBD | Pending | TBD |
|
||||
| QA / Verification Owner | TBD | Pending | TBD |
|
||||
|
||||
## 9. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial threat model template and baseline candidate. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
|
||||
|
||||
## Desktop Push-to-Talk Threat Addendum (Baseline Candidate 0.9.3)
|
||||
|
||||
| ID | Threat | Asset | Likelihood | Impact | Mitigation |
|
||||
|---|---|---|---|---|---|
|
||||
| THREAT-PTT-001 | A desktop PTT backend logs raw key codes or scan codes to the in-memory log sink. | User keystroke privacy | Medium (without controls) | High | `PttSanitizer` per SAD-077 / SDD-090 drops records with banned field names before they reach any sink; backend implementations call `AudioTransmitGate::set` only and never log key data. |
|
||||
| THREAT-PTT-002 | A desktop PTT backend leaks raw key codes through the user-initiated diagnostic export. | User keystroke privacy | Medium | High | Diagnostic export carries only the capability level, backend identifier, and bound input class per SRS-202 / DEC-027. |
|
||||
| THREAT-PTT-003 | The application advertises Global PTT support on a platform / permission / environment where it does not actually work. | Honest release claim | Medium | Medium (UX regression, support load) | `PttCapabilityLevel` is published from the *active* backend only; the UI capability badge reflects runtime measurement (SRS-196 / SysRS-298). Release readiness record carries per-platform evidence per SysDes-148. |
|
||||
| THREAT-PTT-004 | A missed key-up event leaves `transmit_active` true after the user releases the binding (for example because the OS suppressed the event while Chanora was minimised). | Voice transmission integrity, user expectation of mute | Medium | Medium | `MissedKeyUpWatchdog` per SAD-079 / SDD-092 self-clears `transmit_active` after a configured timeout (default 30 s); the watchdog timeout is a P0 requirement per DEC-028. |
|
||||
| THREAT-PTT-005 | A malicious or buggy third-party application registers a global hook that intercepts Chanora's binding and forces PTT on. | Voice transmission integrity | Low | Medium (user can mitigate by switching binding) | Out of MVP scope; documented as a deferred risk. Chanora reports the active backend identifier so a support investigation can correlate. |
|
||||
| THREAT-PTT-006 | macOS Input-Monitoring / Accessibility permission is revoked at runtime; the application continues to claim Global PTT. | Honest capability state | Low | Medium | `MacOSEventTapBackend` re-queries the permission state on each tap-disabled callback and downgrades to `L0Focused` via `BridgeEvent::PttCapability`. |
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.3 | 2026-05-15 | Added desktop PTT threats THREAT-PTT-001..006: raw key logging, key data in diagnostic export, capability over-claim, missed key-up, third-party hook interference, and macOS permission revocation. |
|
||||
Reference in New Issue
Block a user