VeilPair Threat Model — Assets, Actors, and Threat Analysis

Assets and Actors

Protected Assets

Personal Contact Information: Phone numbers, LINE IDs, emails, and social handles shared during handoffs.
Ephemeral Conversation Content: Temporary messages exchanged during the handoff.
Pairing Tokens & Session Credentials: Authentication tokens permitting entry into private rooms.

Threat Actors

Crawler / Link Preview Bot: Automated scrapers prefetching links on public forums.
Room Sniper / Unintended Opener: A third-party user who clicks a public link before the intended recipient.
Malicious Participant: A user attempting to harvest contact info under false pretenses.
External Network Attacker: An eavesdropper or automated brute-force attacker.

Threat Analysis & Mitigation Matrix

Below is the evaluation of primary attack vectors against the VeilPair handoff protocol:

Threat Vector	Impact	Current Mitigation	Residual Risk	Status
Crawler Prefetch / Preview Bot	Bot consumes link token before human user clicks	GET requests only render the public endpoint; creating a pairing request requires an authenticated, rate-limited POST.	A crawler or automation capable of running the client flow and sending POST requests can still create a request.	Partially Mitigated
Unauthorized Opener	A third party opens a publicly shared handoff link and creates a request.	Opening the link alone does not grant conversation access; the owner must approve a pending request.	Unauthorized requests can still create noise or persuade an inattentive owner.	Partially Mitigated
Room Sniping	A third party is approved instead of the intended public persona.	The owner can compare the request code with a code posted by the public persona in the original context.	The workflow depends on the owner checking the correct thread and code; copied codes and social engineering remain possible.	Partially Mitigated
Link Leakage	A handoff URL is copied, logged, or shared beyond the intended context.	Endpoints have random slugs, configurable expiration, request limits, pause/revoke controls, and an optional single-pairing setting.	Anyone possessing an active link can view its public metadata and submit a request.	Partially Mitigated
Code Guessing	An attacker guesses a human-readable pairing code.	Codes are tied to a specific pending request, expire after 15 minutes, and do not authenticate a conversation by themselves.	The code space is intentionally human-readable and must not be treated as a high-entropy credential.	Partially Mitigated
Brute Force / Request Flooding	An attacker floods authentication, pairing, messaging, or contact endpoints.	Process-local fixed-window rate limits protect sensitive mutations and return standard rate-limit headers.	Counters reset on process restart and are not shared across multiple application instances.	Partially Mitigated
Session Hijacking	An attacker uses a stolen bearer token to access the victim's rooms.	JWT signatures, TLS in Production, origin restrictions, and authorization checks protect normal requests.	Product tokens are stored client-side, expire after 7 or 30 days, and have no per-session server-side revocation mechanism.	Partially Mitigated
Token Leakage	A product bearer token or room identifier is exposed through device compromise, malicious script, or user sharing.	Security headers, input validation, TLS, and random identifiers reduce common exposure paths.	A valid leaked bearer token remains usable until expiry; the product does not use HttpOnly authentication cookies.	Partially Mitigated
Replay Attack	An attacker reuses a resolved pairing request or old code.	Accepted and rejected requests leave the pending state, and a pairing code alone cannot open a conversation.	Existing bearer tokens and active multi-use endpoints remain valid according to their independent lifecycles.	Partially Mitigated
Enumeration	An attacker probes public endpoint slugs, user-facing errors, or identifiers to discover active resources.	Endpoint slugs and record identifiers use random values, and private API access requires authorization.	Public endpoint metadata is intentionally returned for a valid active slug; automated probing remains possible within rate and network limits.	Partially Mitigated
Server Compromise / Operator Access	An operator or compromised server reads messages, contact cards, account records, or stored analytics.	TLS protects network transport, application access is isolated, and unsaved rooms expire automatically.	The server necessarily processes plaintext application content and the datastore is not end-to-end encrypted.	Not Mitigated
Metadata Exposure	Infrastructure or observers learn IP, request timing, referrer, language, path, or interaction metadata.	Room records do not attach raw IP addresses; analytics use aggregate counts and truncated daily IP-derived hashes.	Reverse proxies and hosting systems may retain request metadata, and first-party analytics remain persisted.	Partially Mitigated
Abuse / Spam	Users employ public links or private rooms for harassment, phishing, spam, or unlawful activity.	Owners approve requests, participants can close/destroy rooms, mutation endpoints are rate-limited, and a feedback/safety form exists.	VeilPair does not verify identity, moderate every message, or guarantee participant intent.	Partially Mitigated