sigmashake-docs — Threat Model
STRIDE per surface. Last fully reviewed 2026-05-27. Surfaces and controls corrected 2026-10-10 to match what the docs site is: a static site on Cloudflare Pages with no accounts, sessions, database, or audit log.
Surfaces
1. Public static site (docs.sigmashake.com)
Assets. Published documentation content; the integrity of the install and verification instructions that readers copy.
| STRIDE | Threat | Mitigation |
|---|---|---|
| Spoofing | Look-alike site that copies the docs | HTTPS on the canonical host; readers get checksum and signature steps on the Verify downloads page. |
| Tampering | Modified page content at deploy time | The deploy script (deploy-guarded.sh) checks that the working tree matches origin/main only when SSG_DEPLOY_STRICT=1 is set. The check is not enforced by default. The content is plain files in git, so changes are visible in history. |
| Repudiation | A deploy with no record | Git history records each content change. The site has no per-action audit log. |
| Info disclosure | Private data in published pages | The site holds no customer data and has no accounts. Authors review pages before merge. |
| DoS | Traffic flood | Cloudflare edge network serves static files. There is no origin compute to exhaust. |
| EoP | Privilege escalation | Not applicable. The site has no runtime code, no roles, and no sign-in. |
2. Local agent tools (src/mcp.ts, tools/docs-cli.ts)
Assets. The local docs/ files.
| STRIDE | Threat | Mitigation |
|---|---|---|
| I | Data sent to a remote host | The tools read the local docs/ files only and make no network requests. |
Cross-cutting controls
- No stored data. The site stores no customer data and has no audit log. For services that keep an audit log, see the Security & Trust page and the platform threat models.
- Secrets handling. The site has no secrets binding (see
wrangler.toml). - Dependency hygiene. A locally scheduled
bun audit --prodrecords its result in a sentinel file. It is not a blocking gate: no build or deploy stops on a high or critical result. The local timer can miss runs (for example when the machine sleeps).
Findings tracker
| # | Finding | Severity | Status |
|---|---|---|---|
| (initial threat model — no open findings as of 2026-05-27) |
AI-assisted internal security review — 2026-06-18
Reviewer: Claude Opus 4.8 (Anthropic) Date: 2026-06-18 Methodology: White-box, code-level AI-assisted internal security review conducted by Claude Opus 4.8 (Anthropic) with full source-code access, aligned to OWASP WSTG v4.2 and OWASP ASVS v4.0.3. Static source analysis of authn, input validation, SSRF/open-redirect surface, secret handling, response headers, crypto hygiene, and honesty-contract copy. Disclaimer: AI-assisted internal security review (Claude Opus 4.8) — not a third-party penetration test. This review was conducted by an AI system (Claude Opus 4.8, Anthropic) under operator direction with full source-code access on 2026-06-18. It is NOT a third-party human penetration test; no external offensive-security firm and no CPA firm has been engaged. It does not substitute for a human-led engagement by a certified (CREST/OSCP/GPEN) firm. It is appended alongside — and does not replace — the prior Claude Opus 4.7 (2026-05-19) review record.
Confirmed findings (2026-06-18 round)
| ID | File | Line | Title | Severity | Status |
|---|---|---|---|---|---|
| DOCS-2026-0618-01 | docs/security/threat-model.md | 15, 32 | The sigmashake-gov governance audit log was loosely described as "Merkle-chained" — corrected to per-row Ed25519-signed. (The sigmashake-fleet cloud audit log and the sigmashake-compliance / hub transparency log are separately Merkle / hash-chained — distinct logs, correctly labeled on the fleet and CLI pages.) Retracted 2026-10-13: the "per-row Ed25519-signed" description is wrong for the shipped Go ssg. Audit rows are unsigned (the signature column stays NULL because nothing calls BackfillSignature), and audit_log is rotated at the row caps (50,000-row soft cap, 500,000-row hard ceiling), so it is not append-only. | Medium | Fixed in this document; description retracted 2026-10-13 |
| DOCS-2026-0618-02 | docs/security.md | 162 | SOC 2 Type II "targeted for Q4 2026" overstates timeline (observation window ends 2026-11-17; earliest report Q1 2027; no CPA firm engaged) | Medium | Fixed |
| DOCS-2026-0618-03 | docs/customer/security-whitepaper.md | 57 | "SOC 2 Type II (in progress)" lacks readiness/no-CPA-firm qualifier | Low | Fixed |
| DOCS-2026-0618-04 | docs/compliance/iso27001/vulnerability-management-procedure.mdx | 27, 70 | "Annual third-party penetration test" presented as established control; no third-party pentest has been performed | Low | Fixed |
| DOCS-2026-0618-05 | docs/fleet-policies.md | 101 | Dangling reference to docs/security/mdm-agent-update-pentest-2026-05-20.md (file does not exist); mislabeled as "pentest review" | Low | Fixed |
| DOCS-2026-0618-06 | docs/policies/security.md | 11 | "immutable content verification" overclaims; model is tamper-evident (hash/signature detection) | Low | Fixed |
Clean areas (2026-06-18 round)
src/mcp.ts— stdio MCP server is local-only and read-only; no network exposure beyond local filesystem access.