edgeVerified in code and tests
Public edge and rendering
Cloudflare ingress, security headers, cache boundaries, canonical host handling and removal of untrusted internal headers.
Qeravio trust center
Security verification, without the security theatre.
This is Qeravio's first formal threat model for the product that exists today. It shows what was checked in code and tests, what is only partially proven, and what must remain closed until stronger evidence exists.
8mapped surfaces
17registered threats
12verified controls
0known high or critical production dependency findings
Claim boundary
This is not an external penetration test or a security certification.
The current evidence covers source inspection, automated regression tests, dependency audit and public release probes. Live multi-account member testing, organization isolation, WAF and load exercises, and a complete live billing lifecycle are not proven.
01 / Scope
Every current trust surface has a named state.
A future feature does not inherit today's security claim.
identityVerified in code and tests
Identity and session
Single-use magic links, hashed tokens, bounded return paths and secure session cookies.
memberPartially verified
Member data and mutations
Server-side identity, owner-scoped queries, same-origin mutation guards, bounded input and private no-store responses. A live entitled journey is still pending.
internalVerified in code and tests
Internal operations
Service routes use a minimum-length bearer secret with constant-time digest comparison. Internal UI routes require a server-verified owner session and same-origin mutation checks.
mcpVerified in code and tests
Public MCP tools
Five bounded read-only tools, production-only host and Origin allowlists, no-store responses and edge rate limiting.
pluginPartially verified
Plugin distribution
Pinned archives, exact checksums, bounded manifests and traversal-safe lifecycle tests. Publisher signing is not yet available.
billingPartially verified
Billing boundary
Production billing fails closed. Webhook signature, source, size, idempotency and ownership controls exist, but no real charge is claimed.
organizationFuture surface
Organization tenancy
Organization accounts and tenant administration are not implemented, so tenant isolation is not claimed or tested.
02 / Controls
Controls are linked to evidence, not adjectives.
- SEC-001Browser security headerspostdeploy-contract · public-release-probe
- SEC-002Untrusted internal-header strippingworker-routing-source · security-verification-tests
- SEC-003Bounded same-site return pathsauth-verify-tests · security-verification-tests
- SEC-004Hashed single-use identity tokens and secure cookiesauth-email-tests · auth-verify-tests
- SEC-005Same-origin guards on every member mutation routesecurity-verification-tests
- SEC-006Bounded JSON and field validationroute-specific-tests · billing-request-body-tests
- SEC-007Layered abuse rate limitsworker-routing-source · route-specific-tests
- SEC-008Constant-time internal authorizationautomation-health-tests · security-verification-tests
- SEC-009Production-only MCP host and Origin boundarymcp-server-tests · public-release-probe · security-verification-tests
- SEC-010Pinned package integrity and safe extractionplugin-distribution-tests · isolated-plugin-lifecycle
- SEC-011Fail-closed billing and verified webhook processingbilling-release-tests · billing-webhook-tests · public-release-probe
- SEC-012Private no-store response boundarypostdeploy-contract · public-release-probe
- SEC-013Known-vulnerability dependency gatepnpm-production-audit · lockfile
- SEC-014Server-verified owner role on internal UI routesowner-route-tests · security-verification-tests
03 / Threat register
The residual risk stays visible.
Severity describes the threat if the control fails. Status describes the evidence available today.
TM-001HighVerified in code and tests
Spoofing
Forged trusted request headers
Residual riskCloudflare and runtime configuration remain part of the trust base.
SEC-002
TM-002HighVerified in code and tests
Spoofing
Replay of a sign-in link or session token
Residual riskCompromise of the user's mailbox or endpoint is outside this control set.
SEC-003SEC-004
TM-003HighVerified in code and tests
Tampering
Cross-site member-state change
Residual riskRequests without an Origin remain supported for non-browser clients and still require a valid session.
SEC-004SEC-005
TM-004MediumVerified in code and tests
Spoofing
Open redirect after authentication
Residual riskNew authentication routes must reuse the same bounded return-path helper.
SEC-003
TM-005HighPartially verified
Information disclosure
Unauthenticated or cross-account member data access
Residual riskGuest rejection and owner-scoped tests pass; an entitled multi-account production journey is still pending.
SEC-004SEC-012
TM-006MediumVerified in code and tests
Tampering
Oversized, malformed or unexpected input
Residual riskEvery future mutation route must join the bounded-input inventory.
SEC-006SEC-007
TM-007MediumPartially verified
Denial of service
Request flooding and resource exhaustion
Residual riskNo production load, WAF or chaos exercise has been completed.
SEC-006SEC-007
TM-008CriticalVerified in code and tests
Spoofing
Unauthorized internal operation
Residual riskSecret rotation and platform access governance remain operational responsibilities.
SEC-008SEC-012SEC-014
TM-009HighVerified in code and tests
Spoofing
MCP host or browser-Origin confusion
Residual riskLocalhost access is possible only when an explicit development flag is set.
SEC-009
TM-010HighVerified in code and tests
Elevation of privilege
A public AI tool mutates an external system
Residual riskAny future write-capable tool requires a separate authorization and threat-model version.
SEC-009
TM-011HighPartially verified
Tampering
Modified archive or unsafe extraction path
Residual riskChecksums and traversal tests pass; publisher signing is not available and is not claimed.
SEC-010
TM-012HighVerified in code and tests
Tampering
Known vulnerable production dependency
Residual riskAn audit is point-in-time evidence and must run again for every release.
SEC-013
TM-013CriticalVerified in code and tests
Spoofing
Forged, duplicated or reordered billing webhook
Residual riskThe complete live payment lifecycle has not been executed and is not claimed.
SEC-006SEC-011
TM-014CriticalVerified in code and tests
Elevation of privilege
Production charging opens without every release gate
Residual riskBilling remains disabled; enabling it requires a separate live evidence gate and explicit authority.
SEC-011
TM-015HighVerified in code and tests
Information disclosure
Private data stored in a shared cache
Residual riskEvery new private route must remain in the no-store release inventory.
SEC-012
TM-016HighPartially verified
Information disclosure
Cross-site scripting in public content
Residual riskThe current runtime still permits inline scripts and styles. Nonces or hashes are a future hardening gate.
SEC-001SEC-006
TM-017CriticalFuture surface
Elevation of privilege
Cross-tenant organization access
Residual riskOrganization tenancy does not exist yet. It must not launch before isolation tests and administrator controls exist.
No current control
04 / Open gates
What must happen before the claim can grow.
- 01Independent external penetration testing of the deployed release.
- 02Entitled multi-account production journeys for every member mutation route.
- 03Production load, WAF and recovery exercises with retained evidence.
- 04Publisher signing and verified identity for downloadable plugin packages.
- 05Nonce or hash-based CSP that removes the current inline-script allowance.
- 06Organization isolation and administrator-abuse tests before any tenant feature launches.
- 07A complete sandbox and live billing lifecycle before production charging is enabled.
Read the exact boundary