1.7 KiB
1.7 KiB
Chanora Threat Model
Document status: DV meeting baseline candidate
Date: 2026-05-29
1. Scope
This threat model covers the Chanora client, local storage, diagnostics, bridge boundary, protocol adapter, audio path, platform services, and release artifacts. External compatible servers are outside Chanora control.
2. Assets
| Asset | Protection goal |
|---|---|
| Server passwords and identities | Prevent plaintext persistence and diagnostic leakage |
| Voice audio | Avoid unintended transmit and preserve user control |
| Diagnostic logs | Redact secrets before user-initiated export |
| Local bookmarks/settings | Preserve integrity and avoid accidental disclosure |
| Release artifacts | Preserve integrity and accurate capability claims |
3. Primary Threats
| Threat | Mitigation | Current DV status |
|---|---|---|
| Secret leakage in diagnostics | Known-secret registry and redactor | Requires export evidence |
| Plaintext or weak secret storage | Platform secure-storage abstraction and encryption | Android DEK waiver active |
| Stuck push-to-talk transmit | Missed-key-up watchdog and transmit gate | Requires platform PTT evidence |
| Protocol-library leakage into UI | Protocol adapter isolation | Architecture baseline covers boundary |
| Malicious or misconfigured external server | Treat server as external dependency and expose safe errors | Requires compatible-server/negative evidence |
| Over-claiming platform support | Capability records and release policy | Release record controls claims |
4. DV Conclusion
Major threats and mitigations are identified. Final release requires audit evidence for secure storage, diagnostics, platform PTT, and release artifacts.