Identity and security
Threat model
Threats and controls for tenant isolation, untrusted code, AI access, identity, and recovery.
v1 design baseline. This page specifies intended behavior. Delivery and validation are tracked in the implementation plan; it is not a claim that the platform is already implemented.
| Threat | Primary controls |
|---|---|
| Cross-tenant IDOR | Explicit tenant context, Laravel policies, RLS, composite constraints, tests |
| Malicious generated code | OS/VM sandbox, workerd capability model, no ambient credentials |
| Malicious build dependency | Disposable sandbox, package proxy, restricted egress, no production secrets |
| Sandbox escape | MicroVM/gVisor boundary, patched hosts, separate trusted services |
| SSRF | Mandatory egress proxy, private-range denial, redirect and DNS-rebinding protection |
| Secret exfiltration | Integration proxies, no build secrets, redacted logs, scoped runtime binding |
| Control-plane cookie attack | Separate runtime apex, __Host- cookies, CSRF/origin validation |
| Identity-header spoofing | Strip inbound intrnl headers, signed internal assertion |
| MCP confused deputy | OAuth grant bound to user/org/scopes; reauthorize every tool call |
| AI self-approval | Approval service refuses agent identities |
| Webhook forgery/replay | Signature, timestamp, delivery dedupe |
| Repository race | Build exact SHA, immutable revision record |
| Artifact tampering | Digest-addressing, signing, runtime verification |
| Preview data exposure | Separate DB, synthetic seed, restricted access |
| Route/origin bypass | Private origin/tunnel, authenticated edge, no public workload ports |
| Entra group overage | App roles/assigned groups, SCIM, explicit overage handling |
| Destructive migration | Classification, approval, pre-migration snapshot |
| Log leakage | Central redaction, body logging off, retention policy |
| Denial of service | Per-app limits, rate limiting, quotas, sandbox resource controls |
| Supply-chain compromise | Lockfiles, pinned builder image, SBOM, scanning, signed artifacts |
| Orphaned applications | Org ownership, business/technical owners, lifecycle review |
| Runtime-agent compromise | Per-cluster mTLS, narrow commands, no central DB credentials |
| Privilege escalation through policy | Mandatory organization ceilings, versioned policy, approval |
| Shared-domain browser attack | Separate registrable runtime domain |
A third-party penetration test should occur before pilot production use.