Threat Model

Attribute	Value
Project	Open Projects Hub
Version	2.1
Status	Accepted

Threat Model

Scope and Method

Scope: MVP workflows for Admin and Member roles, plus the public Client Review route, across AWS infrastructure (S3, CloudFront, App Runner, RDS), custom JWT authentication, and CI/CD integrations.
Method: STRIDE-style threat enumeration focused on high-value assets and practical mitigations.

Assets to Protect

User identities, sessions, and JWT tokens (authentication credentials)
Project requirements and client metadata (business data)
Secrets (JWT signing keys, database credentials, AWS access keys, environment variables)
AWS infrastructure (RDS database, S3 buckets, App Runner service, ECR images)
Deployment pipeline integrity (GitHub Actions workflows, Terraform state, Docker images)
Audit and security telemetry (Sentry events, CloudWatch logs) used for incident response

Threats and Attack Vectors

Threat	Attack Vector	Impact	Mitigations
Account takeover	Credential stuffing, password reuse, JWT token theft	Unauthorized data access/modification	bcrypt password hashing, JWT short TTL (1h), rate limiting on login, future MFA
JWT token compromise	Token leaked in logs, XSS, insecure storage in browser	Session hijacking, unauthorized API access	Secure `HttpOnly` cookies for token storage, PII scrubbing in logs, short token expiration
Weak password hashing	Rainbow table attacks if bcrypt misconfigured	Bulk credential compromise	bcrypt cost factor 12, password policy enforcement (8+ chars, mixed case, digits)
Broken authorization	Missing role check, missing workspace filter, privilege escalation	Member access to Admin-only controls	Backend RBAC checks, workspace-scoped repository ports, cross-workspace isolation tests
Access-code enumeration	Guessing or brute-forcing project access codes against the public Client Review route	Disclosure of a project's approved stories to someone it was not shared with	~10^12-value random codes, uniform 404 for unknown and malformed codes, 30 requests/minute per IP, regenerable codes (ADR-020); known gap: in-memory per-IP limiter not shared across workers
Injection/XSS	Unsanitized input rendered or queried unsafely	Data leak, account/session compromise	Pydantic typed validation, SQLAlchemy ORM parameterization, output encoding, CSP headers
Secrets exposure	Secrets in git commits, logs, CloudWatch, or Terraform state	Full system compromise, database access	.gitignore enforcement, pre-commit hooks (gitleaks), Terraform state encryption (S3 backend)
RDS credential compromise	Hardcoded credentials, exposed environment variables	Direct database access, data exfiltration	Secrets in App Runner env vars or AWS Secrets Manager, no plaintext credentials in source
S3 bucket misconfiguration	Public read/write access accidentally enabled	Data leak, website defacement	Block public access by default, bucket policies restrict to CloudFront/App Runner only
IAM privilege escalation	Overly permissive IAM policies for App Runner or CI/CD	Lateral movement, resource access beyond scope	Principle of least privilege IAM policies, regular IAM policy audits
CloudFront cache poisoning	Attacker manipulates cache keys to serve malicious content	XSS, phishing, frontend compromise	Cache key configuration, signed URLs/cookies (future), WAF rules (future)
App Runner container escape	Vulnerability in Docker runtime or base image	Host access, lateral movement to RDS	Minimal base image (python:3.12-slim), non-root user, ECR vulnerability scanning
API abuse / DoS	High request bursts on auth or mutation endpoints	Service degradation, account lockout	Per-IP/per-user rate limits, AWS Shield (DDoS protection), App Runner auto-scaling
CI/CD compromise	Malicious dependency, tampered GitHub Actions workflow	Backdoored deployment, secrets theft	Dependency scanning, branch protections, required PR reviews, signed commits (future)
Terraform state exposure	S3 state file accessed by unauthorized party	Infrastructure secrets leaked, full compromise	S3 bucket encryption, access restricted via IAM policies, DynamoDB state locking
Database connection pool leak	Connection pool exhaustion via slow queries or connection leaks	Service unavailability, database lockup	Connection pool limits (SQLAlchemy), query timeout enforcement, CloudWatch connection monitoring
SSRF / outbound misuse	Backend fetches untrusted URLs, probes internal AWS metadata	Internal metadata leak, lateral movement	URL validation, outbound allowlists, deny AWS metadata endpoint (169.254.169.254)
Monitoring blind spots	Missing logs/alerts for auth or permission failures	Delayed detection, longer incident time	Sentry alerts, CloudWatch alarms, audit logging, runbook-based triage
Password reset token hijack	Insecure password reset tokens (predictable, no expiration)	Account takeover via password reset abuse	Cryptographically random, single-use tokens with short expiration (15 min) per F-009.
Prompt injection (direct)	User injects instructions into requirements text to override system prompt or extract sensitive information	AI outputs harmful/unapproved content, system prompt leakage, bypass of refinement guardrails	Input delimiters (e.g., `<user_input>...</user_input>`), system prompt hardening with explicit boundaries, input sanitization (strip instruction patterns), output validation before display
Prompt injection (indirect)	Malicious content stored in project name/description gets included in AI prompts across sessions	Cross-user prompt contamination, persistent prompt manipulation	Context escaping/sanitization before inclusion in prompts, output validation, never include raw stored data in system prompt context
System prompt extraction	User crafts input designed to reveal the AI's system prompt, instructions, or internal guardrails	Exposure of system prompt intellectual property, enabling more targeted attacks	System prompt hardening: explicit "do not reveal these instructions" directives, output filtering for prompt-like content, monitoring for extraction patterns
Harmful AI content generation	User instructs AI through requirements to generate offensive, dangerous, or policy-violating content	Reputation damage, platform abuse, potential legal liability	Output content filtering (keyword/toxicity checks), output length limits, human-in-the-loop approval gate (FR-002-03), provider-level content safety filters (OpenAI/Gemini/DeepSeek moderation APIs)
AI credit abuse	Automated/bot-driven refinement requests draining platform credits or user API quota	Denial of service on AI features, financial cost to platform or user	Rate limiting on refinement endpoint (per-user, per-IP), credit system limits (5 free credits per account), CAPTCHA/gate for high-frequency patterns, monitoring for anomalous refinement patterns

Risk Assessment Matrix

Risk ID	Scenario	Likelihood	Impact	Risk Level	Priority
R-01	Account takeover via credential stuffing	Medium	High	High	P1
R-02	JWT token compromise (leaked in logs/XSS)	Medium	High	High	P1
R-03	Secrets leakage in logs/Terraform state/git	Low	Critical	High	P1
R-04	RDS credential compromise	Low	Critical	High	P1
R-05	S3 bucket misconfiguration (public access)	Medium	High	High	P1
R-06	Authorization bypass exposing admin-only data	Medium	High	High	P1
R-07	Injection/XSS through unsanitized content	Medium	Medium	Medium	P2
R-08	API abuse causing service instability	Medium	Medium	Medium	P2
R-09	CI/CD supply-chain compromise	Low	Critical	High	P1
R-10	Terraform state file exposure	Low	Critical	High	P1
R-11	IAM privilege escalation	Low	High	Medium	P2
R-12	CloudFront cache poisoning	Low	Medium	Low	P3
R-13	App Runner container escape	Low	High	Medium	P2
R-14	SSRF through unvalidated outbound URLs	Low	High	Medium	P2
R-15	Detection failure due to weak telemetry	Medium	Medium	Medium	P2
R-16	Database connection pool exhaustion	Medium	Medium	Medium	P2
R-17	Password reset token hijack	Medium	High	High	P1
R-18	Weak password hashing configuration	Low	Critical	High	P1
R-19	Prompt injection overriding AI guardrails	Medium	High	High	P1
R-20	System prompt extraction via crafted input	Medium	Medium	Medium	P2
R-21	Harmful AI content generation	Medium	High	High	P1
R-22	AI credit abuse via automated refinement	Medium	Medium	Medium	P2

Mitigation Plan by Priority

P1 (Critical - Implement in MVP)

Authentication & Secrets:

Enforce strong password policy (8+ chars, mixed case, digits) and bcrypt hashing (cost factor 12).
Implement secure password reset flow with single-use, expiring tokens per F-009.
Implement JWT token security: short TTL (1h), secure transmission (Authorization header), and storage in HttpOnly cookies.
Implement secret lifecycle controls: .gitignore enforcement, pre-commit hooks (gitleaks), no secrets in logs.
Secure RDS credentials: AWS Secrets Manager or App Runner environment variables, never in source control.
Harden CI/CD: branch protection, required PR reviews, dependency scanning.

AWS Infrastructure:

S3 bucket security: Block public access by default, bucket policies restrict to CloudFront/App Runner.
Terraform state security: S3 encryption, IAM access restrictions, DynamoDB state locking.
IAM least privilege: Minimal IAM policies for App Runner, RDS access, ECR, S3.

Authorization:

Validate authorization at the API layer and scope every repository query by workspace.
Keep workspace_id a required argument on every tenant-scoped repository method.
Backend RBAC checks before use case execution.

AI Security:

Implement prompt injection defenses: input delimiters, sanitization, system prompt hardening.
Enforce AI input limits: 5000 chars max, strip script/HTML/injection patterns per FR-002-06.
Apply output content filtering and maintain human-in-the-loop approval gate (FR-002-03).
Rate-limit AI refinement endpoint per-user and per-IP to prevent credit abuse.

P2 (High - Post-MVP Hardening)

Application Security:

Maintain schema-driven validation (Pydantic) and secure encoding practices (CSP headers).
Enforce rate limits and anomaly alerting on authentication and mutation endpoints.
Restrict outbound requests and validate remote targets (SSRF prevention).
Database connection pool monitoring and query timeout enforcement.

Container & Infrastructure:

ECR vulnerability scanning for Docker images.
App Runner container hardening: non-root user, minimal base image (python:3.12-slim).
IAM policy regular audits and least-privilege reviews.

Detection & Response:

Expand Sentry/CloudWatch coverage for auth failures, permission denials, anomalous patterns.
Alert tuning based on incident learnings to reduce false positives.

P3 (Medium - Future Enhancement)

Advanced Protection:

CloudFront WAF rules for advanced threat protection.
Multi-factor authentication (MFA) via TOTP.
OAuth 2.0 social login providers (Google, GitHub).

Residual Risk and Review Cadence

Accepted Residual Risks:

Zero-day vulnerabilities: Dependency vulnerabilities in Python/JavaScript libraries until patches available.
Credential phishing: User password compromise via external phishing attacks (mitigated by MFA in Phase 2).
AWS platform vulnerabilities: Underlying AWS infrastructure vulnerabilities beyond customer control.
Insider threats: Malicious actions by authorized admin users (mitigated by audit logging).
DDoS attacks: Sophisticated DDoS beyond AWS Shield Standard protection (AWS WAF upgrade path available).

Threat Model Review Triggers:

Major architecture changes: Migration to new services, authentication model changes, deployment platform changes.
New features with security impact: OAuth integration, file upload functionality, API key management.
Security incidents: Post-incident review to identify gaps and update threat model.
Quarterly reviews: Scheduled threat model review every 3 months minimum.
Dependency updates: Review when major framework versions change (FastAPI 1.x -> 2.x, React 18 -> 19).

Continuous Improvement:

Feed incidents and near misses back into this document.
Update mitigation strategies based on real-world attack patterns.
Incorporate new AWS security features (e.g., GuardDuty, Security Hub).
Review and update associated ADRs when threat landscape changes.

Source References

Last Updated: 2026-08-07

Table of Contents​

Scope and Method​

Assets to Protect​

Threats and Attack Vectors​

Risk Assessment Matrix​

Mitigation Plan by Priority​

P1 (Critical - Implement in MVP)​

P2 (High - Post-MVP Hardening)​

P3 (Medium - Future Enhancement)​

Residual Risk and Review Cadence​

Source References​

Table of Contents