Spaces:
Paused
Paused
| # Security Model | |
| ## Threat model | |
| | Threat | Mitigation | | |
| |----------------------------------------------|----------------------------------------------------------------------------------| | |
| | Credential stuffing / brute force | bcrypt + account lockout after 8 failures (15 min) | | |
| | Session hijack | Short access TTL (30 min) + refresh rotation + device fingerprint + revoke UI | | |
| | CSRF | Double-submit cookie pattern; `CSRFMiddleware` blocks unsafe w/o header | | |
| | XSS via rich text | `rehype-sanitize` on all markdown + safe Prism highlighter + KaTeX | | |
| | Secret exfiltration to browser | API responses never include `apiKey` plaintext; only `hasApiKey` flag | | |
| | System prompt leakage | Admin-only endpoints; `SystemPromptOut` field names strip content for non-admins| | |
| | SSRF via web search | Only outbound GET to `http(s)` URLs; HTML cleaned, no JS executed | | |
| | Rate limit abuse | Redis fixed-window per (user\|IP) on all sensitive endpoints | | |
| | Mass assignment | Strict Pydantic models; `exclude_none` on updates; `extra=ignore` config | | |
| | Mongo injection | BSON ObjectId validation; no raw `$where`/`$function` | | |
| | Log injection | Structured `structlog` JSON, request ID propagated, secrets redacted in logger | | |
| | TLS downgrade | Nginx forces HSTS, TLS 1.2+ ciphers, HTTP → HTTPS redirect | | |
| | Clickjacking | `X-Frame-Options: DENY` + CSP `frame-ancestors 'none'` | | |
| | Open redirect | Login redirects stay on same origin via Next.js route guards | | |
| | Memory poisoning | Memory items stored per-user; only owners can list/delete; admins audit access | | |
| | Prompt injection | System prompt assembled server-side from admin-curated content + user memory; user message never injected into the system block; tool/function calls not yet exposed | | |
| ## Encryption at rest | |
| - **API keys** stored in `models.encryptedApiKey` as Fernet tokens. | |
| - **System prompts** stored in plaintext (they are not secrets) but **never sent** to non-admin clients. | |
| - **Refresh tokens** stored hashed (sha256) so DB leak does not enable session replay. | |
| ## Transport | |
| - TLS terminated at Nginx; backend listens plain HTTP behind the proxy. | |
| - Cookies: `Secure` (production), `HttpOnly` (refresh), `SameSite=Lax` by default. | |
| - Security headers: CSP, HSTS (1y, includeSubDomains), X-Content-Type-Options=nosniff, X-Frame-Options=DENY, Referrer-Policy=strict-origin-when-cross-origin, Permissions-Policy. | |
| ## Logging | |
| - `structlog` JSON to stdout. | |
| - `x-request-id` propagated from client or generated, returned in response. | |
| - Timing header `x-response-time-ms`. | |
| - `audit_logs` collection is append-only from the application's perspective; only superadmin can soft-archive (out of scope for v1). | |
| ## Rate limiting | |
| - Fixed-window per (user id, IP fallback), configurable via `RATE_LIMIT_PER_MIN`. | |
| - Default 120/min. | |
| - Returns `429` with `Retry-After`. | |
| ## Future hardening (out of scope for v1) | |
| - Argon2id migration path (config flag). | |
| - WebAuthn / passkeys. | |
| - mTLS for admin endpoints. | |
| - Per-IP WAF rules. | |
| - Vector-based prompt-injection classifier on user inputs. | |