# Sec Threat Model V0.9.2.2.1

**Document type:** Security / Threat Model  
**Version:** 0.9.2  
**Status:** Baseline Candidate  
**Language:** English  
**Product:** Chanora  
**Repo path:** `docs/security/threat-model.md`  ---

## 1. Purpose

This document identifies Chanora security assets, trust boundaries, attack surfaces, threat scenarios, mitigations, and residual risks.

This document must be completed and approved before public or external release.

## 2. Security Scope

In scope:

- Identity private keys and identity material
- Server passwords
- Saved bookmarks and recent server entries
- Local database
- Secure storage
- Diagnostic logs and export bundles
- Protocol input from compatible servers
- Text messages, channel names, server names, and nicknames
- Audio device access and microphone permission
- Platform permission flows
- Dependency and supply-chain risks
- Flutter/Rust bridge boundary
- Local file export/import surfaces

Out of scope unless later added:

- Cloud account sync
- Server hosting infrastructure operated by Chanora
- Telemetry backend
- Crash reporting backend
- Payment processing

## 3. Assets

| Asset ID | Asset | Sensitivity | Required protection |
|---|---|---|---|
| SEC-ASSET-001 | Identity private key / identity secret | Critical | Store only in platform secure storage; never log. |
| SEC-ASSET-002 | Server password | Critical | Store only in platform secure storage; redact from diagnostics. |
| SEC-ASSET-003 | Server address / bookmark | Sensitive | Store locally; redact or minimize in diagnostic export. |
| SEC-ASSET-004 | Nickname / user identity display name | Personal / user-provided | Preserve Unicode; avoid unnecessary upload. |
| SEC-ASSET-005 | Channel names and server names | Potentially sensitive | Treat as user/server content; redact where configured. |
| SEC-ASSET-006 | Chat text | Sensitive user/server content | Do not upload automatically; redact from diagnostics by default unless user explicitly includes. |
| SEC-ASSET-007 | Diagnostic bundle | Sensitive aggregate | Redact secrets; user-initiated export only. |
| SEC-ASSET-008 | Local database | Sensitive | Protect via OS file permissions; avoid plaintext secrets. |
| SEC-ASSET-009 | Logs | Sensitive | Redact secrets and avoid verbose sensitive content. |
| SEC-ASSET-010 | Audio stream | Sensitive real-time data | Do not persist audio unless explicitly designed later. |
| SEC-ASSET-011 | Dependency graph | Supply-chain-sensitive | Track licenses, vulnerabilities, and source integrity. |

## 4. Trust Boundaries

| Boundary ID | Boundary | Risk |
|---|---|---|
| TB-001 | User input to Flutter UI | Malformed or hostile input. |
| TB-002 | Flutter to Rust bridge | DTO validation and error mapping required. |
| TB-003 | Rust Core to protocol adapter | Protocol events and external inputs must be normalized. |
| TB-004 | Protocol adapter to external compatible server | Untrusted network/server input. |
| TB-005 | Rust/Flutter to platform secure storage | Platform-specific failure modes. |
| TB-006 | App to local database/file system | File tampering, data leakage, permissions. |
| TB-007 | Diagnostics export to user-controlled destination | Sensitive data leakage. |
| TB-008 | Audio device boundary | Permission and device-route privacy. |
| TB-009 | Dependency supply chain | Vulnerable or malicious dependencies. |

## 5. Attack Surfaces

| Surface ID | Attack surface | Example threats |
|---|---|---|
| AS-001 | Connection form | Credential capture in logs, malformed host input. |
| AS-002 | Protocol input | Malformed packets, hostile names/messages, state desync. |
| AS-003 | Bridge DTOs | Invalid commands, unexpected event payloads. |
| AS-004 | Local database | Tampering, unauthorized read. |
| AS-005 | Secure storage | Platform fallback failure or incorrect secret classification. |
| AS-006 | Diagnostics export | Secret leakage, excessive server/user information. |
| AS-007 | Logs | Password or identity leakage. |
| AS-008 | Audio permissions | Unclear microphone use or unintended capture. |
| AS-009 | Dependency ecosystem | Vulnerable packages or license incompatibility. |
| AS-010 | Store/package distribution | Tampered artifacts or signing issues. |

## 6. Threat Scenarios and Mitigations

| Threat ID | Scenario | Impact | Mitigation | Verification |
|---|---|---|---|---|
| THR-001 | Server password is logged during connection failure. | Credential leakage. | Redaction filters; never log secret fields. | Diagnostic redaction audit. |
| THR-002 | Identity private key is stored in local DB. | Identity compromise. | Secure storage classification and audit. | Secure storage audit. |
| THR-003 | Diagnostic export includes server password or identity secret. | Credential leakage. | Export redaction and denylist/allowlist design. | Redaction audit. |
| THR-004 | Hostile server sends malformed Unicode or extremely long names. | Crash, UI corruption, log injection. | Boundary validation, length limits, safe rendering. | Protocol fuzz/sanitization tests. |
| THR-005 | Protocol event causes inconsistent UI state. | Wrong user/channel state. | State reducer validation and snapshot recovery. | SWE.5/SWE.6 tests. |
| THR-006 | Dependency has known critical vulnerability. | Compromise or exploit risk. | Dependency scan and release gate. | Supply-chain report. |
| THR-007 | OSS license is incompatible with release model. | Legal/compliance risk. | License inventory and legal review. | Dependency/license report. |
| THR-008 | Microphone permission is unclear to user. | Privacy risk. | Permission explanation and privacy policy. | Privacy/legal review. |
| THR-009 | Logs contain private channel or nickname data by default. | Privacy leakage. | Minimize logs; redact or hash sensitive content. | Diagnostics audit. |
| THR-010 | Build artifact is not traceable to commit. | Supply-chain/release integrity risk. | Release record with commit, tag, build number, hashes. | Go/No-Go record. |

## 7. Residual Risks

| Risk ID | Risk | Disposition |
|---|---|---|
| RISK-001 | External compatible servers may expose untrusted content. | Accept with boundary validation and safe rendering. |
| RISK-002 | Platform secure storage behavior differs by OS/version. | Mitigate with per-platform audit. |
| RISK-003 | Dependency vulnerabilities may appear after release. | Mitigate with recurring scan and patch policy. |
| RISK-004 | Diagnostic bundles may contain contextual sensitive data even after redaction. | Mitigate with user confirmation and privacy notice. |

## 8. Approval

| Role | Name | Decision | Date |
|---|---|---|---|
| Security Reviewer | TBD | Pending | TBD |
| Software Architect | TBD | Pending | TBD |
| Platform Owner | TBD | Pending | TBD |
| QA / Verification Owner | TBD | Pending | TBD |

## 9. Change History

| Version | Date | Description |
|---|---|---|
| 0.9.0 | 2026-05-14 | Initial threat model template and baseline candidate. |


## Baseline Candidate 0.9.1 Update

| Version | Date | Description |
|---|---|---|
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |


## Baseline Candidate 0.9.2 Update

| Version | Date | Description |
|---|---|---|
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |


## Desktop Push-to-Talk Threat Addendum (Baseline Candidate 0.9.3)

| ID | Threat | Asset | Likelihood | Impact | Mitigation |
|---|---|---|---|---|---|
| THREAT-PTT-001 | A desktop PTT backend logs raw key codes or scan codes to the in-memory log sink. | User keystroke privacy | Medium (without controls) | High | `PttSanitizer` per SAD-077 / SDD-090 drops records with banned field names before they reach any sink; backend implementations call `AudioTransmitGate::set` only and never log key data. |
| THREAT-PTT-002 | A desktop PTT backend leaks raw key codes through the user-initiated diagnostic export. | User keystroke privacy | Medium | High | Diagnostic export carries only the capability level, backend identifier, and bound input class per SRS-202 / DEC-027. |
| THREAT-PTT-003 | The application advertises Global PTT support on a platform / permission / environment where it does not actually work. | Honest release claim | Medium | Medium (UX regression, support load) | `PttCapabilityLevel` is published from the *active* backend only; the UI capability badge reflects runtime measurement (SRS-196 / SysRS-298). Release readiness record carries per-platform evidence per SysDes-148. |
| THREAT-PTT-004 | A missed key-up event leaves `transmit_active` true after the user releases the binding (for example because the OS suppressed the event while Chanora was minimised). | Voice transmission integrity, user expectation of mute | Medium | Medium | `MissedKeyUpWatchdog` per SAD-079 / SDD-092 self-clears `transmit_active` after a configured timeout (default 30 s); the watchdog timeout is a P0 requirement per DEC-028. |
| THREAT-PTT-005 | A malicious or buggy third-party application registers a global hook that intercepts Chanora's binding and forces PTT on. | Voice transmission integrity | Low | Medium (user can mitigate by switching binding) | Out of MVP scope; documented as a deferred risk. Chanora reports the active backend identifier so a support investigation can correlate. |
| THREAT-PTT-006 | macOS Input-Monitoring / Accessibility permission is revoked at runtime; the application continues to claim Global PTT. | Honest capability state | Low | Medium | `MacOSEventTapBackend` re-queries the permission state on each tap-disabled callback and downgrades to `L0Focused` via `BridgeEvent::PttCapability`. |

| Version | Date | Description |
|---|---|---|
| 0.9.3 | 2026-05-15 | Added desktop PTT threats THREAT-PTT-001..006: raw key logging, key data in diagnostic export, capability over-claim, missed key-up, third-party hook interference, and macOS permission revocation. |