THREAT_MODEL.md

Interview in progress. Answer the open questions from the model to resolve owner decisions and finalise residual risk.

INTERVIEW PROGRESS
Question 2 of 3 1 answered
9
Assets tracked
4
Critical assets
13
Entry points
3
Owner decisions
ASSETS
claude_credentials
OAuth token + Anthropic key, plaintext in Postgres, injected into every agent
CRITICAL
host_claude_dir
Host ~/.claude bind-mounted read-write into the API container
CRITICAL
dev_host_integrity
Code-execution / process integrity on the developer's machine
CRITICAL
postgres_data
Shared DB: clarifications, plans, chat logs, per-project secrets
HIGH
ENTRY POINTS & TRUST BOUNDARIES
aegis_local_api (0.0.0.0:3000)
LAN / any interface → unauthenticated API
GET /api/config/settings
unauth API → stored secrets, unredacted
Agent spawn (issue_key)
HTTP → autonomous agent, checks disabled
CORS origin:true
any browser origin → API
OWNER DECISIONS · erange · 2026-07-05
Machine treated as single-tenant & trusted — cross-project isolation is a non-goal (T5 accepted).
Local API is intentionally unauthenticated by design — AEGISARC_TOKEN is not a live control.
Unsandboxed agent accepted given human-in-the-loop approval gates (T3 accepted).
12
Threats modelled
4
Critical impact
5
Unmitigated
3
Risk-accepted
ID
THREAT
IMPACT
LIKELIHOOD
STATUS
T1
Remote code execution on the dev host via the unauth, LAN-exposed API spawning a permission-disabled agent
CRITICALLikelyUnmitigated
T2
Disclosure of stored Claude / Anthropic / Linear secrets via the unauth config endpoint
CRITICALLikelyUnmitigated
T3
Unsandboxed agent RCE via prompt injection in an attacker-authored project file
CRITICALPossibleAccepted
T5
Cross-tenant read/write of other projects' data via a forgeable X-Project-Id slug
HIGHLikelyAccepted
T6
Browser CSRF / DNS-rebinding driving the local API from any page the dev visits
HIGHLikelyPartial
T8
Compromise of all projects' DB via weak default Postgres credentials
MEDIUMPossiblePartial
DEPRIORITISED
SQL injection · Drizzle ORM parameterised bindings throughout
Dynamic code exec · zero eval / Function / vm sinks
Repudiation · single-user local tool
8
Recommended fixes
4
Quick wins · effort S
3
Open questions
RECOMMENDED MITIGATIONS
Bind the API to 127.0.0.1 & enforce AEGISARC_TOKEN bearer auth on every route
T1T2T5T6
PartialM
Redact secret-valued config rows in all API responses
T2
ClosesS
Constrain CORS to the extension / webview origin instead of reflect-any
T6
ClosesS
Set non-default Postgres credentials via required env
T8
ClosesS
OPEN QUESTIONS
Is the 0.0.0.0 bind deliberate, or should it be 127.0.0.1? Pivotal.
Should /api/config/settings redact secrets, or is unredacted read-back deliberate?
Is the remote agent-spawn trigger path acceptable?
PROVENANCE
mode  bootstrap-then-interview
date  2026-07-05
target  aegisarc-studio @ 1c3b9bbc
owner  erange