chore(repo): initial baseline import (docs v0.9.2 + bootstrap)
Imports the v0.9.2 documentation baseline and the bootstrap files required by docs/governance/repository-bootstrap-plan.md v0.1.0 §3, minus the justfile (added in the next commit). This commit establishes the git history for the project. All previous work lived only as filesystem state with no version control.
This commit is contained in:
EdisonJwa
@@ -0,0 +1,126 @@
|
||||
# Sec Dependency And Supply Chain Report V0.9.2.2.1
|
||||
|
||||
**Document type:** Security / Dependency and Supply Chain Report
|
||||
**Version:** 0.9.2
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/dependency-and-supply-chain-report.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This report records Chanora dependency inventory, license review, vulnerability review, SBOM status, and supply-chain release readiness.
|
||||
|
||||
## 2. Dependency Scope
|
||||
|
||||
| Ecosystem | In scope |
|
||||
|---|---|
|
||||
| Flutter / Dart | `pubspec.yaml`, transitive packages, Flutter SDK version |
|
||||
| Rust | `Cargo.toml`, `Cargo.lock`, crates, features |
|
||||
| Protocol library | `tsclientlib` and related crates/dependencies |
|
||||
| Native audio | Platform audio libraries, native build dependencies, bindings |
|
||||
| Build tooling | CI actions, build scripts, code generators |
|
||||
| Packaging | Platform packaging tools and signing tools |
|
||||
|
||||
## 3. Required Outputs
|
||||
|
||||
| Output | Required before external release |
|
||||
|---|---|
|
||||
| Dependency inventory | Yes |
|
||||
| License report | Yes |
|
||||
| Vulnerability scan report | Yes |
|
||||
| SBOM | Yes |
|
||||
| Critical/high vulnerability disposition | Yes |
|
||||
| Unknown license disposition | Yes |
|
||||
| Build provenance record | Yes |
|
||||
| Artifact hash record | Yes |
|
||||
|
||||
## 4. Dependency Inventory
|
||||
|
||||
| Component | Ecosystem | Version | License | Source | Risk | Notes |
|
||||
|---|---|---|---|---|---|---|
|
||||
| Flutter SDK | Flutter | TBD | TBD | TBD | TBD | TBD |
|
||||
| Dart packages | Dart | TBD | TBD | TBD | TBD | TBD |
|
||||
| Rust toolchain | Rust | TBD | TBD | TBD | TBD | TBD |
|
||||
| Rust crates | Rust | TBD | TBD | TBD | TBD | TBD |
|
||||
| `tsclientlib` | Rust/protocol | TBD | TBD | TBD | TBD | TBD |
|
||||
| Native audio dependencies | Native | TBD | TBD | TBD | TBD | TBD |
|
||||
| CI actions/tools | Build | TBD | TBD | TBD | TBD | TBD |
|
||||
|
||||
## 5. License Review
|
||||
|
||||
| License category | Policy |
|
||||
|---|---|
|
||||
| Permissive licenses | Generally acceptable after review |
|
||||
| Copyleft licenses | Requires legal review before release |
|
||||
| Unknown licenses | Release blocker until resolved |
|
||||
| Proprietary dependencies | Requires explicit approval |
|
||||
| Incompatible licenses | Release blocker unless removed or legal waiver approved |
|
||||
|
||||
## 6. Vulnerability Review
|
||||
|
||||
| Finding ID | Dependency | Severity | CVE / advisory | Status | Disposition |
|
||||
|---|---|---|---|---|---|
|
||||
| TBD | TBD | TBD | TBD | TBD | TBD |
|
||||
|
||||
## 7. SBOM
|
||||
|
||||
| Field | Value |
|
||||
|---|---|
|
||||
| SBOM format | TBD: SPDX / CycloneDX / other |
|
||||
| SBOM tool | TBD |
|
||||
| SBOM file | TBD |
|
||||
| SBOM generation date | TBD |
|
||||
| SBOM reviewer | TBD |
|
||||
|
||||
## 8. Build Provenance
|
||||
|
||||
| Field | Value |
|
||||
|---|---|
|
||||
| Git commit SHA | TBD |
|
||||
| Git tag | TBD |
|
||||
| CI pipeline ID | TBD |
|
||||
| Build environment | TBD |
|
||||
| Artifact hashes | TBD |
|
||||
| Signing identity | TBD |
|
||||
| Reproducibility status | TBD |
|
||||
|
||||
## 9. Release Gate
|
||||
|
||||
| Gate | Required result |
|
||||
|---|---|
|
||||
| Critical vulnerabilities | None open without approved waiver |
|
||||
| High vulnerabilities | None open without approved waiver |
|
||||
| Unknown licenses | None open without approved waiver |
|
||||
| SBOM | Generated and archived |
|
||||
| License report | Reviewed |
|
||||
| Dependency report | Approved |
|
||||
|
||||
## 10. Approval
|
||||
|
||||
| Role | Name | Decision | Date |
|
||||
|---|---|---|---|
|
||||
| Security Reviewer | TBD | Pending | TBD |
|
||||
| Legal Reviewer | TBD | Pending | TBD |
|
||||
| Engineering Owner | TBD | Pending | TBD |
|
||||
| Release Manager | TBD | Pending | TBD |
|
||||
|
||||
## 11. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial dependency and supply-chain report template. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
@@ -0,0 +1,103 @@
|
||||
# Sec Diagnostic Redaction Audit Report V0.9.2.2.1
|
||||
|
||||
**Document type:** Security / Diagnostic Redaction Audit Report
|
||||
**Version:** 0.9.2
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/diagnostic-redaction-audit-report.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This report records evidence that Chanora logs and diagnostic exports do not leak sensitive information.
|
||||
|
||||
## 2. Sensitive Data Redaction Policy
|
||||
|
||||
| Data category | Default diagnostic behavior |
|
||||
|---|---|
|
||||
| Server password | Must redact |
|
||||
| Identity private key / identity secret | Must redact |
|
||||
| Authentication tokens if later added | Must redact |
|
||||
| Secure-storage keys | Must redact |
|
||||
| Server address | Redact or minimize according to release policy |
|
||||
| Channel names | Redact or include only with explicit user consent |
|
||||
| Client nicknames | Redact or include only with explicit user consent |
|
||||
| Chat messages | Exclude by default unless a future explicit opt-in policy is approved |
|
||||
| Local file paths | Minimize or redact user-identifying segments |
|
||||
| Device IDs | Redact or hash if collected |
|
||||
| IP addresses | Redact or minimize according to release policy |
|
||||
|
||||
## 3. Diagnostic Surfaces
|
||||
|
||||
| Surface | Risk | Required control |
|
||||
|---|---|---|
|
||||
| Application log | Secret leakage | Redaction filter and structured logging discipline |
|
||||
| Protocol log | Hostile or sensitive server content | Redaction and length limits |
|
||||
| Audio diagnostics | Device privacy | Device name minimization if needed |
|
||||
| Export bundle | Aggregated sensitive data | Redaction audit before release |
|
||||
| Error report | Stack trace or secret context | User-safe error mapping |
|
||||
| User support copy/paste | Over-sharing | Explicit review and confirmation |
|
||||
|
||||
## 4. Redaction Test Matrix
|
||||
|
||||
| Test ID | Input | Expected output | Status | Evidence |
|
||||
|---|---|---|---|---|
|
||||
| REDACT-TC-001 | Server password in connection data | Password replaced by `[REDACTED]` | TBD | TBD |
|
||||
| REDACT-TC-002 | Identity secret in storage error | Secret absent | TBD | TBD |
|
||||
| REDACT-TC-003 | Server URL with password-like field | Secret part redacted | TBD | TBD |
|
||||
| REDACT-TC-004 | Chat text in diagnostic export | Excluded by default | TBD | TBD |
|
||||
| REDACT-TC-005 | Channel name with Unicode | Preserved only if permitted; otherwise redacted safely | TBD | TBD |
|
||||
| REDACT-TC-006 | Nickname with Unicode | Preserved only if permitted; otherwise redacted safely | TBD | TBD |
|
||||
| REDACT-TC-007 | Local file path | User-identifying segments redacted or minimized | TBD | TBD |
|
||||
| REDACT-TC-008 | Diagnostic bundle with mixed sensitive fields | All sensitive fields redacted | TBD | TBD |
|
||||
| REDACT-TC-009 | Long hostile protocol string | Truncated or safely escaped | TBD | TBD |
|
||||
| REDACT-TC-010 | Multilingual safe diagnostic text | Unicode preserved | TBD | TBD |
|
||||
|
||||
## 5. Export Bundle Contents
|
||||
|
||||
| Bundle item | Included? | Redaction rule | Status |
|
||||
|---|---|---|---|
|
||||
| App version | Yes | None | TBD |
|
||||
| Build number | Yes | None | TBD |
|
||||
| Platform info | Yes | Minimize device details | TBD |
|
||||
| Connection state | Yes | No secrets | TBD |
|
||||
| Server address | TBD | Redact/minimize | TBD |
|
||||
| Channel tree | TBD | Redact/minimize | TBD |
|
||||
| Chat history | No by default | Exclude unless explicit policy changes | TBD |
|
||||
| Logs | Yes | Redacted | TBD |
|
||||
| Audio diagnostics | Yes | No audio content | TBD |
|
||||
| Secure storage data | No | Never include | TBD |
|
||||
|
||||
## 6. Findings
|
||||
|
||||
| Finding ID | Severity | Description | Status | Owner |
|
||||
|---|---|---|---|---|
|
||||
| TBD | TBD | TBD | TBD | TBD |
|
||||
|
||||
## 7. Approval
|
||||
|
||||
| Role | Name | Decision | Date |
|
||||
|---|---|---|---|
|
||||
| Security Reviewer | TBD | Pending | TBD |
|
||||
| Privacy Reviewer | TBD | Pending | TBD |
|
||||
| QA / Verification Owner | TBD | Pending | TBD |
|
||||
|
||||
## 8. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial diagnostic redaction audit report template. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
@@ -0,0 +1,88 @@
|
||||
# Sec Secure Storage Audit Report V0.9.2.2.1
|
||||
|
||||
**Document type:** Security / Secure Storage Audit Report
|
||||
**Version:** 0.9.2
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/secure-storage-audit-report.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This report records evidence that Chanora stores secrets using platform secure storage mechanisms and does not store sensitive secrets in plaintext local storage.
|
||||
|
||||
## 2. Secret Classification
|
||||
|
||||
| Secret ID | Secret | Required storage |
|
||||
|---|---|---|
|
||||
| SEC-STORE-001 | Identity private key / identity secret | Platform secure storage |
|
||||
| SEC-STORE-002 | Server password | Platform secure storage |
|
||||
| SEC-STORE-003 | Authentication tokens if later added | Platform secure storage |
|
||||
| SEC-STORE-004 | Encryption keys if later added | Platform secure storage |
|
||||
|
||||
## 3. Platform Audit Matrix
|
||||
|
||||
| Platform | Secure storage mechanism | Test status | Evidence | Result |
|
||||
|---|---|---|---|---|
|
||||
| Windows | TBD | TBD | TBD | TBD |
|
||||
| macOS | TBD | TBD | TBD | TBD |
|
||||
| Linux | TBD | TBD | TBD | TBD |
|
||||
| Android | TBD | TBD | TBD | TBD |
|
||||
| iOS | TBD | TBD | TBD | TBD |
|
||||
|
||||
## 4. Audit Checks
|
||||
|
||||
| Check ID | Check | Expected result | Status | Evidence |
|
||||
|---|---|---|---|---|
|
||||
| SS-AUD-001 | Identity secret is not stored in local DB. | Pass | TBD | TBD |
|
||||
| SS-AUD-002 | Server password is not stored in local DB. | Pass | TBD | TBD |
|
||||
| SS-AUD-003 | Secret values are not written to application logs. | Pass | TBD | TBD |
|
||||
| SS-AUD-004 | Secret values are not included in diagnostic export. | Pass | TBD | TBD |
|
||||
| SS-AUD-005 | Secure storage failure returns safe error. | Pass | TBD | TBD |
|
||||
| SS-AUD-006 | Secret deletion removes secure-storage entry. | Pass | TBD | TBD |
|
||||
| SS-AUD-007 | Platform-specific secure storage is documented. | Pass | TBD | TBD |
|
||||
| SS-AUD-008 | Migration or import path does not expose secrets. | Pass | TBD | TBD |
|
||||
|
||||
## 5. Test Cases
|
||||
|
||||
| Test ID | Platform | Procedure | Expected result | Actual result | Status |
|
||||
|---|---|---|---|---|---|
|
||||
| SS-TC-001 | Windows | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
|
||||
| SS-TC-002 | macOS | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
|
||||
| SS-TC-003 | Linux | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
|
||||
| SS-TC-004 | Android | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
|
||||
| SS-TC-005 | iOS | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
|
||||
|
||||
## 6. Findings
|
||||
|
||||
| Finding ID | Severity | Description | Status | Owner |
|
||||
|---|---|---|---|---|
|
||||
| TBD | TBD | TBD | TBD | TBD |
|
||||
|
||||
## 7. Approval
|
||||
|
||||
| Role | Name | Decision | Date |
|
||||
|---|---|---|---|
|
||||
| Security Reviewer | TBD | Pending | TBD |
|
||||
| Platform Owner | TBD | Pending | TBD |
|
||||
| QA / Verification Owner | TBD | Pending | TBD |
|
||||
|
||||
## 8. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial secure storage audit report template. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
@@ -0,0 +1,89 @@
|
||||
# Sec Security Privacy Legal Guideline V0.9.2.2.1
|
||||
|
||||
**Document type:** Security / Privacy / Legal Guideline
|
||||
**Version:** 0.9.2
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/security-privacy-legal-guideline.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This guideline defines the required security, privacy, and legal review documents that must be completed before Chanora is released outside a controlled internal engineering environment.
|
||||
|
||||
A public or external release shall not rely only on SysRS, SysDes, SRS, SAD, SDD, and verification documents. It also requires security, privacy, dependency, and legal evidence.
|
||||
|
||||
## 2. Required Pre-Release Documents
|
||||
|
||||
| Document | Required before | Purpose |
|
||||
|---|---|---|
|
||||
| `docs/security/threat-model.md` | External Beta or public release | Identify attack surfaces, assets, trust boundaries, threats, and mitigations. |
|
||||
| `docs/security/secure-storage-audit-report.md` | Any release storing secrets | Prove platform secure storage behavior. |
|
||||
| `docs/security/diagnostic-redaction-audit-report.md` | Any release with diagnostics export/logs | Prove diagnostics and logs do not leak sensitive information. |
|
||||
| `docs/security/dependency-and-supply-chain-report.md` | Any external release | Prove dependency inventory, licenses, vulnerability status, and SBOM readiness. |
|
||||
| `docs/privacy/privacy-policy.md` | Any public or store release | Explain data handling, local storage, permissions, diagnostics, and upload behavior. |
|
||||
| `docs/legal/trademark-and-attribution-review.md` | Any public or store release | Confirm non-affiliation wording, OSS attribution, and trademark risk review. |
|
||||
|
||||
## 3. Release Gate Rule
|
||||
|
||||
| Release type | Required security/privacy/legal gate |
|
||||
|---|---|
|
||||
| Internal Alpha | Security and privacy draft checklist acceptable if not publicly distributed. |
|
||||
| External Beta | Threat model, secure storage audit, diagnostic redaction audit, dependency report, privacy draft, legal review draft required. |
|
||||
| MVP Public | All listed documents must be completed and approved. |
|
||||
| Store Release | All listed documents must be completed, approved, and aligned with store metadata. |
|
||||
|
||||
## 4. Security Review Principles
|
||||
|
||||
| Principle | Required behavior |
|
||||
|---|---|
|
||||
| Secret minimization | Store only secrets needed for user-approved functionality. |
|
||||
| Local-first diagnostics | Diagnostic export requires explicit user action unless a future policy says otherwise. |
|
||||
| Redaction by default | Secrets and sensitive server/user data are redacted before export. |
|
||||
| Boundary validation | Protocol, platform, and file boundaries validate or sanitize external input. |
|
||||
| Least privilege | Platform permissions are requested only when needed and explained to users. |
|
||||
| Dependency accountability | Flutter packages, Rust crates, native libraries, and protocol libraries are inventoried. |
|
||||
| Release evidence | Security and privacy claims require evidence, not only design intent. |
|
||||
|
||||
## 5. Required Product Owner Decisions
|
||||
|
||||
| Decision | Owner |
|
||||
|---|---|
|
||||
| Whether diagnostics are local-only or upload-capable | Product Owner + Legal |
|
||||
| Whether crash reporting is included | Product Owner + Legal + Security |
|
||||
| Which release channels are used | Product Owner |
|
||||
| Public wording for non-affiliation statement | Legal / Compliance |
|
||||
| Whether any telemetry is collected | Product Owner + Legal |
|
||||
| Minimum supported platforms for secure storage audit | Product Owner + Engineering |
|
||||
|
||||
## 6. Required Engineering Evidence
|
||||
|
||||
| Evidence | Owner |
|
||||
|---|---|
|
||||
| Secure storage test results per platform | Platform / Security |
|
||||
| Diagnostic redaction test results | Security / QA |
|
||||
| Dependency inventory and license output | Engineering / Legal |
|
||||
| SBOM output | Engineering / Security |
|
||||
| Vulnerability scan result | Security / Engineering |
|
||||
| Permission list and justification | Platform / Product |
|
||||
| Threat model review result | Security / Architecture |
|
||||
|
||||
## 7. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial security, privacy, and legal pre-release guideline. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
@@ -0,0 +1,138 @@
|
||||
# Sec Threat Model V0.9.2.2.1
|
||||
|
||||
**Document type:** Security / Threat Model
|
||||
**Version:** 0.9.2
|
||||
**Status:** Baseline Candidate
|
||||
**Language:** English
|
||||
**Product:** Chanora
|
||||
**Repo path:** `docs/security/threat-model.md` ---
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This document identifies Chanora security assets, trust boundaries, attack surfaces, threat scenarios, mitigations, and residual risks.
|
||||
|
||||
This document must be completed and approved before public or external release.
|
||||
|
||||
## 2. Security Scope
|
||||
|
||||
In scope:
|
||||
|
||||
- Identity private keys and identity material
|
||||
- Server passwords
|
||||
- Saved bookmarks and recent server entries
|
||||
- Local database
|
||||
- Secure storage
|
||||
- Diagnostic logs and export bundles
|
||||
- Protocol input from compatible servers
|
||||
- Text messages, channel names, server names, and nicknames
|
||||
- Audio device access and microphone permission
|
||||
- Platform permission flows
|
||||
- Dependency and supply-chain risks
|
||||
- Flutter/Rust bridge boundary
|
||||
- Local file export/import surfaces
|
||||
|
||||
Out of scope unless later added:
|
||||
|
||||
- Cloud account sync
|
||||
- Server hosting infrastructure operated by Chanora
|
||||
- Telemetry backend
|
||||
- Crash reporting backend
|
||||
- Payment processing
|
||||
|
||||
## 3. Assets
|
||||
|
||||
| Asset ID | Asset | Sensitivity | Required protection |
|
||||
|---|---|---|---|
|
||||
| SEC-ASSET-001 | Identity private key / identity secret | Critical | Store only in platform secure storage; never log. |
|
||||
| SEC-ASSET-002 | Server password | Critical | Store only in platform secure storage; redact from diagnostics. |
|
||||
| SEC-ASSET-003 | Server address / bookmark | Sensitive | Store locally; redact or minimize in diagnostic export. |
|
||||
| SEC-ASSET-004 | Nickname / user identity display name | Personal / user-provided | Preserve Unicode; avoid unnecessary upload. |
|
||||
| SEC-ASSET-005 | Channel names and server names | Potentially sensitive | Treat as user/server content; redact where configured. |
|
||||
| SEC-ASSET-006 | Chat text | Sensitive user/server content | Do not upload automatically; redact from diagnostics by default unless user explicitly includes. |
|
||||
| SEC-ASSET-007 | Diagnostic bundle | Sensitive aggregate | Redact secrets; user-initiated export only. |
|
||||
| SEC-ASSET-008 | Local database | Sensitive | Protect via OS file permissions; avoid plaintext secrets. |
|
||||
| SEC-ASSET-009 | Logs | Sensitive | Redact secrets and avoid verbose sensitive content. |
|
||||
| SEC-ASSET-010 | Audio stream | Sensitive real-time data | Do not persist audio unless explicitly designed later. |
|
||||
| SEC-ASSET-011 | Dependency graph | Supply-chain-sensitive | Track licenses, vulnerabilities, and source integrity. |
|
||||
|
||||
## 4. Trust Boundaries
|
||||
|
||||
| Boundary ID | Boundary | Risk |
|
||||
|---|---|---|
|
||||
| TB-001 | User input to Flutter UI | Malformed or hostile input. |
|
||||
| TB-002 | Flutter to Rust bridge | DTO validation and error mapping required. |
|
||||
| TB-003 | Rust Core to protocol adapter | Protocol events and external inputs must be normalized. |
|
||||
| TB-004 | Protocol adapter to external compatible server | Untrusted network/server input. |
|
||||
| TB-005 | Rust/Flutter to platform secure storage | Platform-specific failure modes. |
|
||||
| TB-006 | App to local database/file system | File tampering, data leakage, permissions. |
|
||||
| TB-007 | Diagnostics export to user-controlled destination | Sensitive data leakage. |
|
||||
| TB-008 | Audio device boundary | Permission and device-route privacy. |
|
||||
| TB-009 | Dependency supply chain | Vulnerable or malicious dependencies. |
|
||||
|
||||
## 5. Attack Surfaces
|
||||
|
||||
| Surface ID | Attack surface | Example threats |
|
||||
|---|---|---|
|
||||
| AS-001 | Connection form | Credential capture in logs, malformed host input. |
|
||||
| AS-002 | Protocol input | Malformed packets, hostile names/messages, state desync. |
|
||||
| AS-003 | Bridge DTOs | Invalid commands, unexpected event payloads. |
|
||||
| AS-004 | Local database | Tampering, unauthorized read. |
|
||||
| AS-005 | Secure storage | Platform fallback failure or incorrect secret classification. |
|
||||
| AS-006 | Diagnostics export | Secret leakage, excessive server/user information. |
|
||||
| AS-007 | Logs | Password or identity leakage. |
|
||||
| AS-008 | Audio permissions | Unclear microphone use or unintended capture. |
|
||||
| AS-009 | Dependency ecosystem | Vulnerable packages or license incompatibility. |
|
||||
| AS-010 | Store/package distribution | Tampered artifacts or signing issues. |
|
||||
|
||||
## 6. Threat Scenarios and Mitigations
|
||||
|
||||
| Threat ID | Scenario | Impact | Mitigation | Verification |
|
||||
|---|---|---|---|---|
|
||||
| THR-001 | Server password is logged during connection failure. | Credential leakage. | Redaction filters; never log secret fields. | Diagnostic redaction audit. |
|
||||
| THR-002 | Identity private key is stored in local DB. | Identity compromise. | Secure storage classification and audit. | Secure storage audit. |
|
||||
| THR-003 | Diagnostic export includes server password or identity secret. | Credential leakage. | Export redaction and denylist/allowlist design. | Redaction audit. |
|
||||
| THR-004 | Hostile server sends malformed Unicode or extremely long names. | Crash, UI corruption, log injection. | Boundary validation, length limits, safe rendering. | Protocol fuzz/sanitization tests. |
|
||||
| THR-005 | Protocol event causes inconsistent UI state. | Wrong user/channel state. | State reducer validation and snapshot recovery. | SWE.5/SWE.6 tests. |
|
||||
| THR-006 | Dependency has known critical vulnerability. | Compromise or exploit risk. | Dependency scan and release gate. | Supply-chain report. |
|
||||
| THR-007 | OSS license is incompatible with release model. | Legal/compliance risk. | License inventory and legal review. | Dependency/license report. |
|
||||
| THR-008 | Microphone permission is unclear to user. | Privacy risk. | Permission explanation and privacy policy. | Privacy/legal review. |
|
||||
| THR-009 | Logs contain private channel or nickname data by default. | Privacy leakage. | Minimize logs; redact or hash sensitive content. | Diagnostics audit. |
|
||||
| THR-010 | Build artifact is not traceable to commit. | Supply-chain/release integrity risk. | Release record with commit, tag, build number, hashes. | Go/No-Go record. |
|
||||
|
||||
## 7. Residual Risks
|
||||
|
||||
| Risk ID | Risk | Disposition |
|
||||
|---|---|---|
|
||||
| RISK-001 | External compatible servers may expose untrusted content. | Accept with boundary validation and safe rendering. |
|
||||
| RISK-002 | Platform secure storage behavior differs by OS/version. | Mitigate with per-platform audit. |
|
||||
| RISK-003 | Dependency vulnerabilities may appear after release. | Mitigate with recurring scan and patch policy. |
|
||||
| RISK-004 | Diagnostic bundles may contain contextual sensitive data even after redaction. | Mitigate with user confirmation and privacy notice. |
|
||||
|
||||
## 8. Approval
|
||||
|
||||
| Role | Name | Decision | Date |
|
||||
|---|---|---|---|
|
||||
| Security Reviewer | TBD | Pending | TBD |
|
||||
| Software Architect | TBD | Pending | TBD |
|
||||
| Platform Owner | TBD | Pending | TBD |
|
||||
| QA / Verification Owner | TBD | Pending | TBD |
|
||||
|
||||
## 9. Change History
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.0 | 2026-05-14 | Initial threat model template and baseline candidate. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.1 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
||||
|
||||
|
||||
## Baseline Candidate 0.9.2 Update
|
||||
|
||||
| Version | Date | Description |
|
||||
|---|---|---|
|
||||
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|
||||
Reference in New Issue
Block a user