# Chanora Threat Model

**Document status:** DV meeting baseline candidate  
**Date:** 2026-05-29

## 1. Scope

This threat model covers the Chanora client, local storage, diagnostics, bridge boundary, protocol adapter, audio path, platform services, and release artifacts. External compatible servers are outside Chanora control.

## 2. Assets

| Asset | Protection goal |
|---|---|
| Server passwords and identities | Prevent plaintext persistence and diagnostic leakage |
| Voice audio | Avoid unintended transmit and preserve user control |
| Diagnostic logs | Redact secrets before user-initiated export |
| Local bookmarks/settings | Preserve integrity and avoid accidental disclosure |
| Release artifacts | Preserve integrity and accurate capability claims |

## 3. Primary Threats

| Threat | Mitigation | Current DV status |
|---|---|---|
| Secret leakage in diagnostics | Known-secret registry and redactor | Requires export evidence |
| Plaintext or weak secret storage | Platform secure-storage abstraction and encryption | Android DEK waiver active |
| Stuck push-to-talk transmit | Missed-key-up watchdog and transmit gate | Requires platform PTT evidence |
| Protocol-library leakage into UI | Protocol adapter isolation | Architecture baseline covers boundary |
| Malicious or misconfigured external server | Treat server as external dependency and expose safe errors | Requires compatible-server/negative evidence |
| Over-claiming platform support | Capability records and release policy | Release record controls claims |

## 4. DV Conclusion

Major threats and mitigations are identified. Final release requires audit evidence for secure storage, diagnostics, platform PTT, and release artifacts.