# CipherNest Threat Model

## Overview

CipherNest is an AI Application Security Platform that operates as a VS Code Extension, CLI tool, GitHub App, MCP Server, and MCP Gateway.

CipherNest analyzes source code, AI prompts, agents, MCP configurations, dependencies, CI/CD pipelines, Dockerfiles, Infrastructure-as-Code manifests, and runtime tool interactions to identify security vulnerabilities and policy violations.

Because CipherNest processes potentially sensitive source code, infrastructure configurations, secrets, prompts, and security findings, a clear threat model is essential.

This document defines the assets, trust boundaries, threat actors, attack surfaces, assumptions, and mitigations used throughout the CipherNest platform.

---

# Security Objectives

CipherNest is designed to:

- Protect user source code and repository contents
- Prevent unauthorized access to local files
- Prevent abuse of MCP tools and AI agents
- Prevent secret leakage during analysis
- Protect GitHub integrations from spoofing or abuse
- Provide trustworthy security findings
- Operate safely on potentially malicious repositories

CipherNest follows a defense-in-depth security model and assumes that repositories, prompts, dependencies, and AI-generated code may be intentionally hostile.

---

# Assets

## High Value Assets

The following assets are considered critical:

- Source code repositories
- Infrastructure-as-Code files
- Dockerfiles and container configurations
- Kubernetes manifests
- CI/CD workflows
- MCP configurations
- AI agent definitions
- Security findings
- Audit logs
- Generated SBOMs

## Sensitive Assets

The following assets may contain confidential information:

- API keys
- Access tokens
- Secrets detected during scans
- Environment variables
- Database connection strings
- GitHub webhook payloads
- Pull request metadata
- Policy files (.ciphernest.json)

## External Assets

CipherNest may interact with:

- Anthropic APIs
- OpenAI APIs
- Ollama instances
- GitHub APIs
- MCP Servers
- Third-party dependency registries

---

# Threat Actors

## Malicious Repository Author

An attacker who intentionally crafts source code, prompts, dependencies, or infrastructure files designed to exploit CipherNest during analysis.

Goals:

- Trigger parser failures
- Cause denial of service
- Evade detection
- Poison findings
- Exploit scanner vulnerabilities

---

## Compromised AI Agent

An AI agent that attempts to:

- Exfiltrate sensitive data
- Access unauthorized files
- Execute dangerous tools
- Bypass MCP Gateway controls

---

## External Attacker

An attacker attempting to:

- Spoof GitHub webhooks
- Abuse public endpoints
- Trigger excessive scans
- Manipulate pull request reporting

---

## Insider Threat

A trusted user abusing CipherNest capabilities to:

- Access unauthorized repositories
- Disable protections
- Exfiltrate findings
- Modify policies improperly

---

## Supply Chain Attacker

An attacker leveraging:

- Malicious npm packages
- Dependency confusion
- Typosquatting
- Compromised maintainers
- Malicious CI/CD actions

---

# Trust Boundaries

## User Workspace

Trust Level: Trusted Storage, Untrusted Content

The workspace belongs to the user but may contain:

- Malicious repositories
- Vulnerable code
- Hostile prompts
- Malicious dependencies

CipherNest assumes all repository contents are potentially hostile.

---

## CipherNest Core Engine

Trust Level: Trusted

Responsible for:

- Scanning
- Policy enforcement
- Findings generation
- Scoring

No repository code is executed.

Only static analysis is performed.

---

## VS Code Extension Host

Trust Level: Trusted

The extension executes within VS Code's extension host sandbox.

Webviews are isolated and protected using:

- Content Security Policy (CSP)
- Nonces
- Local-only resources

---

## GitHub Integration

Trust Level: Semi-Trusted

GitHub data is validated before processing.

Incoming webhooks must pass:

- HMAC validation
- Payload validation
- Rate limiting

---

## Reasoning Providers

Trust Level: External

Examples:

- Anthropic
- OpenAI
- Ollama

Reasoning providers are treated as external systems.

Sensitive data should be minimized before transmission.

Structured outputs are validated before use.

---

## MCP Gateway

Trust Level: Enforcement Boundary

The MCP Gateway sits between:

AI Agent
↓
CipherNest Gateway
↓
MCP Server

All tool invocations pass through policy enforcement before execution.

---

# Attack Surfaces

## VS Code Extension

### Threats

- Malicious workspace content
- Path traversal
- Webview injection
- CSP bypass attempts
- Resource exhaustion

### Mitigations

- Workspace path allowlisting
- CSP enforcement
- Local resource loading only
- Nonce-based script execution
- No eval() usage
- SecretStorage for sensitive credentials

---

## CLI

### Threats

- Terminal escape sequence injection
- Malicious repository structures
- Excessive filesystem traversal

### Mitigations

- Output sanitization
- Path validation
- Scan limits
- Ignore and exclusion controls

---

## GitHub App

### Threats

- Webhook spoofing
- Replay attacks
- Comment injection
- Rate limit exhaustion

### Mitigations

- HMAC SHA-256 verification
- Required webhook secrets
- Request size limits
- Markdown escaping
- Repository rate limiting

---

## Reasoning Engine

### Threats

- Prompt injection
- System prompt extraction
- Hallucinated findings
- Cost exhaustion

### Mitigations

- Prompt isolation boundaries
- Structured JSON output validation
- Timeout enforcement
- Fail-safe parsing
- Multi-provider support

---

## MCP Gateway

### Threats

- Tool abuse
- Data exfiltration
- Command injection
- SQL injection
- Unauthorized filesystem access

### Mitigations

- Tool inspection
- Argument validation
- SQL injection detection
- Command injection detection
- Workspace path allowlists
- Secret redaction in logs
- Audit logging

---

## MCP Server

### Threats

- Arbitrary filesystem access
- Symlink escape attacks
- Excessive repository scans

### Mitigations

- Workspace root allowlists
- Canonical path validation
- Symlink protection
- Scan scope restrictions

---

# Security Assumptions

CipherNest assumes:

- The host operating system is not compromised.
- VS Code security boundaries remain intact.
- GitHub webhook secrets remain confidential.
- API credentials are stored securely.
- Users review findings before applying fixes.
- Third-party dependencies are regularly updated.
- MCP servers behave according to their documented behavior.

If these assumptions are violated, security guarantees may be reduced.

---

# Privacy Considerations

CipherNest prioritizes local analysis whenever possible.

Local scanners process:

- Source code
- Infrastructure files
- Dependencies
- Prompts

without transmitting data externally.

When reasoning providers are enabled:

- Selected findings may be sent to configured providers.
- Responses are validated before use.
- Providers are treated as external systems.

Users are responsible for ensuring compliance with organizational data handling policies.

---

# Logging & Audit Trails

CipherNest maintains structured audit logs for:

- Scan execution
- Findings creation
- Suppressions
- Policy actions
- MCP tool decisions

Audit logs:

- Redact secrets automatically
- Support export for compliance review
- Rotate automatically to prevent uncontrolled growth

---

# Out of Scope

CipherNest does not:

- Guarantee vulnerability-free software
- Detect every zero-day vulnerability
- Replace professional security reviews
- Replace penetration testing
- Execute code in a secure sandbox
- Guarantee correctness of third-party LLM responses

CipherNest is intended to augment, not replace, secure software development practices.

---

# Future Security Enhancements

Planned improvements include:

- Sandboxed code analysis
- Offline reasoning models
- Runtime agent monitoring
- Enhanced MCP Gateway policy enforcement
- Advanced behavioral analysis
- Enterprise policy packs
- Continuous security benchmarking

---

# Conclusion

CipherNest is designed using a defense-in-depth architecture that assumes scanned repositories, prompts, dependencies, and agent workflows may be actively hostile.

The platform combines static analysis, policy enforcement, runtime controls, auditability, and secure integration boundaries to reduce risk across modern AI-powered software development environments.
