Threat model

What Aftershock protects, from whom, and how. Every release is reviewed against the checklist at the end.

#Assets

#Actors

• Workspace members: authenticated through GitHub; roles owner, admin, member.
• Other tenants: authenticated users of a different workspace.
• Anonymous internet: hits public pages, webhooks, badge, MCP and API endpoints.
• Untrusted content authors: anyone who can write an issue, alert, postmortem, PR description, code comment or commit message that Aftershock reads. This includes prompt-injection attempts against the model.
• Untrusted code: the customer's repository and its dependencies, plus the model's draft. All of it executes during runs.

#Trust boundaries and controls

1. Internet → webhooks (/api/webhooks/*)
   • HMAC signatures (or, for sources without a signing scheme, a per-workspace token) are verified in constant time before parsing.
   • Per-source rate limits.
   • A payload size cap and a ±5 minute replay window wherever the source sends a timestamp.
   • Incidents are deduplicated by source fingerprint.
2. Internet → API, MCP and badge
   • API tokens are compared by hash; sessions are HS256 JWTs.
   • Per-caller rate limits.
   • Tokens carry scopes (read, write).
   • The badge answers 404 for private or unknown repositories, so it can't be used to find out whether a repository exists.
3. Tenant ↔ tenant
   • Every query goes through scoped(workspaceId).
   • Resource ids from the client are always re-checked against the session's workspace.
4. App → model
   • Untrusted text is wrapped in random-nonce fences (lib/model/fence.ts).
   • Model output is parsed as JSON and validated: one file, inside the allowed path, of the right framework, defining a test, with balanced brackets.
   • A model never decides anything is proven or safe; only test runs do.
   • Custom model endpoints must be public https:// hosts (no private, loopback or link-local addresses).
5. App → runner (untrusted code)
   • One fresh microVM (Vercel Sandbox) or container (Docker) per run.
   • The network is allowed only while dependencies install, then set to deny-all before any test runs. A test fails the build if the network is still open after a snapshot is restored.
   • No secrets enter a run. The clone token is read-only, scoped to one repository, and not left in the working tree.
   • Run time and output size are capped. Paths written into the run are checked by safeTestPath.
6. App → GitHub
   • Writes go only to aftershock/* branches, check runs and comments; nothing is ever pushed to a default branch.
   • Clone tokens are minted with the minimum permission.
7. App → outbound webhooks and Slack
   • URLs are resolved before connecting, and private, loopback, link-local and metadata addresses are refused (SSRF guard).
   • Bodies are signed with Standard Webhooks (HMAC-SHA256 over id, timestamp and body).
   • Retries use back-off; a target that keeps failing is disabled automatically.
8. Operators
   • Kill switch AFTERSHOCK_RUNS_DISABLED.
   • Secrets are redacted from structured logs.
   • Migrations run only on production builds and are backward-compatible, so rollback stays safe.

#Threats and mitigations

#Release security checklist

For every milestone:

• New endpoints: authentication, scoped() tenancy, rate limit, size limits, and input validation with zod or explicit checks.
• New outbound calls: SSRF guard, timeouts, no secrets in URLs or logs.
• New stored secrets: encrypted with lib/crypto.ts, never returned after creation.
• New untrusted text reaching a model: fenced, with output validated.
• New run types: network denied during tests, no secrets, metered, covered by the kill switch.
• Migrations: additive and backward-compatible.
• npm audit reports 0 vulnerabilities; tests cover the abuse case, not only the happy path.