kite/.planning/milestones/v0.2-phases/10-ux-interaction/10-SECURITY.md

phase, slug, status, threats_open, asvs_level, created, register_authored_at_plan_time

phase	slug	status	threats_open	asvs_level	created	register_authored_at_plan_time
10	ux-interaction	verified	0	2	2026-06-17	true

Phase 10 — Security

Retroactive security contract for Phase 10: UX & Interaction.

Trust Boundaries

Boundary	Description	Data Crossing
Browser window events → Vue UI handlers	Keyboard shortcuts, drag events, modal Escape handlers, and menu positioning are handled client-side only.	Event metadata; no secrets or server-side authority.
OS file drag → OsDragOverlay → existing upload flow	Files arrive through the browser DataTransfer API and are forwarded into the existing authenticated upload path.	Browser-controlled File objects; existing quota/auth checks still apply on upload.
Route metadata → layout selection	/admin/* layout selection hides the user sidebar and shows admin chrome.	Route metadata only; backend/admin guard remains unchanged.
Vue templates → user-visible text	Breadcrumbs, empty states, toasts, and dropdown labels render through Vue interpolation.	Store/view strings; Vue escaping preserved.

Threat Register

Threat ID	Category	Component	Disposition	Mitigation	Status
T-10-01	Cross-Site Scripting	Breadcrumb, empty state, toast, and dropdown text rendering	mitigate	Vue template interpolation is used; no v-html or raw HTML injection introduced by Phase 10 UI components.	closed
T-10-02	Information Disclosure	Toast notifications	mitigate	Toast payloads are generic action results such as upload/delete/rename/revoke status; no document content, extracted text, credentials, or token material is displayed.	closed
T-10-03	Tampering	OsDragOverlay file drop handling	accept	Handler reads browser-provided dataTransfer.files, resets overlay state, and emits to the existing authenticated upload flow; no direct server write bypass is introduced.	closed
T-10-04	Elevation of Privilege	Admin route layout selection	accept	App.vue admin branch changes presentation only; router requiresAdmin guard and backend get_current_admin enforcement are unchanged.	closed
T-10-05	Spoofing	Keyboard shortcut dispatch through current route instance	accept	Shortcuts call methods on the mounted Vue route component only; no URL parameter or user-supplied string selects privileged behavior.	closed
T-10-06	Denial of Service	Global keyboard and drag listeners	mitigate	Event listeners are added once at component mount and removed on unmount; drag overlay uses a bounded dragDepth counter and ignores non-file drags.	closed
T-10-07	Supply Chain	Phase 10 frontend changes	accept	No new runtime packages were introduced by Phase 10; changes are Vue components, tests, and existing Tailwind/Vitest usage.	closed
T-10-08	Supply Chain	Vite/esbuild dev dependency audit	mitigate	npm audit --audit-level=high found GHSA-gv7w-rqvm-qjhr through vite@6.4.3/esbuild@0.25.12; Vite was upgraded to ^8.0.16, then audit, tests, and build were re-run.	closed

Status: open · closed Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)

Accepted Risks Log

Risk ID	Threat Ref	Rationale	Accepted By	Date
AR-10-01	T-10-03	The drop handler cannot bypass upload authorization or quota checks because it delegates to the existing upload flow.	project owner	2026-06-17
AR-10-02	T-10-04	Layout selection is presentation-only; authorization remains in router/backend gates.	project owner	2026-06-17
AR-10-03	T-10-05	Route-instance method lookup is local Vue state, not user-controlled input.	project owner	2026-06-17
AR-10-04	T-10-07	No new dependency was added in Phase 10.	project owner	2026-06-17

Audit Evidence

Source	Finding
10-01-SUMMARY.md through 10-12-SUMMARY.md	Threat flags are either "None" or document UI-only behavior with no new auth/network/schema surface.
10-13-PLAN.md	Contains a STRIDE register for the UAT gap-closure plan; all threats have accepted dispositions.
10-13-SUMMARY.md	Confirms gap-closure changes are display-only template/event-handler updates with no new network endpoints, auth paths, or schema changes.
10-VERIFICATION.md	Confirms 15/15 Phase 10 requirements passed after gap closure and no anti-patterns remain.
10-VALIDATION.md	Confirms Phase 10 validation coverage for UX and interaction requirements.
npm audit --audit-level=high	Initially found a high-severity esbuild advisory through Vite; after upgrading to Vite ^8.0.16, npm reported 0 vulnerabilities.

Security Audit Trail

Audit Date	Threats Total	Closed	Open	Run By
2026-06-17	8	8	0	Codex (milestone audit remediation)

Sign-Off

• All threats have a disposition.
• Accepted risks documented.
• No Phase 10 change introduces backend routes, auth changes, DB schema changes, or direct storage writes.
• Existing upload/auth/admin enforcement remains the authority boundary.
• High-severity npm audit finding resolved by Vite 8 upgrade.
• threats_open: 0 confirmed.

Approval: verified 2026-06-17