# Threat model

## Protected assets

- File contents, metadata, previews, and replacement-recovery blobs.
- Password, sessions, TOTP secrets, recovery codes, API tokens, share tokens, and OnlyOffice secrets.
- Database-to-object mapping, backup data, and blob manifests.

## Trust boundaries

- Browser to Nginx Proxy Manager to Drive HTTP service.
- Drive to PostgreSQL on the private container network.
- Drive to managed cache/array mounts.
- Drive to the existing OnlyOffice Document Server.
- Public-link visitors to explicitly shared resources.
- Read-only importer mounts to managed Drive storage.
- Future WebDAV/rclone credentials to an explicitly granted Drive subtree and action set.

## Primary threats

- Unclaimed-instance takeover before first-run setup.
- Session theft, CSRF, credential guessing, token leakage, and proxy-address spoofing.
- Path traversal, symlink following, MIME confusion, malicious previews, and archive expansion.
- SSRF or forged OnlyOffice callbacks.
- Over-broad, leaked, or revoked integration credentials and protocol gateways that bypass application services.
- Stale writes, duplicate requests, interrupted commits, and premature GC.
- Secret disclosure through logs, images, configuration, backups, or repository history.

## Phase 0 controls

- Production setup must finish before proxy exposure; setup is disabled atomically after owner creation.
- Secrets are environment/file inputs and ignored by Git.
- Non-root container, explicit mounts, private PostgreSQL network, and health endpoints.
- Architectural boundaries prevent HTTP code from reaching database or managed storage directly.
- Security headers, CSRF, authentication, rate limits, scoped tokens, and callback validation are implemented with their Phase 1 features.
- Phase 1 credentials are independently revocable and may be restricted by subtree and action; future gateways must use them and the canonical mutation path.

Review this document whenever a new external integration, public endpoint, preview processor, or authentication mechanism is introduced.