Threat Model (STRIDE)

Systematic threat analysis for this codebase's critical flows. Updated per major feature change.

Trust Boundaries

graph TB
    subgraph "Public Internet"
        Browser["Browser Client"]
        Webhook["Payment Webhooks"]
        OAuth["OAuth Providers"]
    end

    subgraph "Edge Layer"
        Middleware["Next.js Middleware<br/>(proxy.ts)"]
        CDN["Vercel CDN"]
    end

    subgraph "Application Layer"
        ServerActions["Server Actions"]
        APIRoutes["API Routes"]
        AIChat["AI Chat Service"]
    end

    subgraph "Data Layer"
        Supabase["Supabase Auth + DB"]
        Redis["Upstash Redis"]
        Gemini["Google Gemini API"]
        PaymentAPIs["Payment Provider APIs"]
    end

    Browser --> CDN --> Middleware --> ServerActions
    Middleware --> APIRoutes
    ServerActions --> Supabase
    ServerActions --> AIChat --> Gemini
    APIRoutes --> PaymentAPIs
    Webhook --> APIRoutes
    OAuth --> Middleware
    Middleware --> Redis

1. Authentication Flow

Scope: Email + password, OAuth (Google/GitHub enabled; Discord/Twitter/Apple/Facebook/LinkedIn scaffolded but commented), magic link, passkeys, MFA (TOTP).

Threat	Category	Mitigation	Status
Credential stuffing	Spoofing	Edge rate limiting (60 req/min/IP), circuit breaker (5 violations → 24h ban)	✅
Session hijacking	Spoofing	httpOnly + Secure + SameSite=Lax cookies, HMAC-bound CSRF token validation	✅
Account takeover	Spoofing	Step-up authentication (re-verification) for high-risk actions (password, MFA)	✅
MFA bypass via OAuth	Spoofing	Universal MFA in middleware — AAL1→AAL2 on all auth methods	✅
Password brute force	Spoofing	Argon2id (Supabase), failed attempts →`auth_events`	✅
Token replay	Tampering	Short-expiry JWT, auto-refresh in middleware, PKCE for OAuth	✅
Login enumeration	Info Disclosure	Generic error, no timing leaks	✅
MFA service failure	DoS	Fail-closed: redirect to login on AAL check error	✅
Role escalation	Privilege Elevation	RLS prevents self-role-update,`IS NOT DISTINCT FROM` check	✅

Residual Risks:

Magic link interception in transit (mitigated: short expiry, HTTPS callback)
Passkey attestation not verified (relying on Supabase defaults)

2. Payment Processing Flow

Scope: 5 providers (Stripe, Polar, LemonSqueezy, Dodo, Creem), webhooks, subscription sync.

Threat	Category	Mitigation	Status
Webhook forgery	Spoofing	HMAC-SHA256 per provider	✅
Duplicate replay	Tampering	Retry-safe event claim via `webhook_logs` table	✅
Duplicate entitlement	Tampering	Unique provider subscription/payment IDs deduplicate terminal billing state	✅
Price manipulation	Tampering	Server-side lookup from `PRICING_TIERS`, never trusts client	✅
Provider API hang	DoS	30s timeout via AbortController	✅
Subscription tampering	Tampering	Service-role-only INSERT/UPDATE RLS	✅
Redirect phishing	Spoofing	Same-origin allowlisted checkout and portal return URLs	✅
PCI data exposure	Info Disclosure	Zero card storage — delegated to providers via hosted checkout	✅

Residual Risks:

Provider-side compromise sends valid signatures with malicious data (mitigated: Zod validation)
Webhook delivery failure causes state drift (mitigated: provider retry + manual reconciliation)
Provider cancellation failure during account deletion leaves paid user data intact for retry rather than deleting local state first

3. AI Chat Flow

Scope: Gemini-powered support, RAG pipeline, knowledge base.

Threat	Category	Mitigation	Status
Prompt injection	Tampering	System prompt via `systemInstruction` (separated from user content)	⚠️
KB poisoning	Tampering	Super-Admin-only management (RLS)	✅
Credit farming	DoS	Per-tier rate limiting via centralized client IP attribution,`credits_used` tracking	✅
Conversation IDOR	Info Disclosure	`getConversationForUser()` verifies authenticated conversation ownership	✅
PII in responses	Info Disclosure	System prompt instructs no PII disclosure	⚠️
API key leak	Info Disclosure	Server-side only, never in `NEXT_PUBLIC_*`	✅
Gemini failure	DoS	Try-catch + user-friendly error	✅

Residual Risks:

Multi-turn injection could shift AI behavior (mitigate: per-conversation system prompt)
RAG context could surface sensitive content (mitigate: per-user RAG scoping)

4. ️ super-admin Panel Flow

Scope: super-admin dashboard, user management, impersonation, analytics.

Threat	Category	Mitigation	Status
Unauthorized super-admin access	Spoofing	Middleware-level `profiles.role` check	✅
Impersonation abuse	Repudiation	HMAC-signed context cookie; logged with super-admin ID, target ID, timestamp; 1h expiry; read-time super-admin/target revalidation	✅
Mass data modification	Tampering	Append-only `activity_logs` + `auth_events`	✅
Super-Admin session theft	Spoofing	Same session security + super-admin-only cookie scope	✅
Privilege escalation	Privilege Elevation	RLS `IS NOT DISTINCT FROM` prevents self-role change	✅

Residual Risks:

Compromised super-admin = broad access (mitigate: MFA required, single super-admin default)

5. Multi-Tenant Organization Flow

Scope: Org creation, invitations, RBAC, org switching.

Threat	Category	Mitigation	Status
Cross-org data access	Info Disclosure	`active_org_id` scoping + RLS	✅
Invitation forgery	Spoofing	Server-side token validation, single-use	✅
Org role escalation	Privilege Elevation	Owner/super-admin permission required (server-side)	✅
Seat limit bypass	DoS	Serializable invitation acceptance transaction around capacity check and member add	✅
Org billing leak	Info Disclosure	Billing filtered by org membership + RLS	✅

Residual Risks:

Org owner transfer lacks email verification (mitigate: confirmation flow)

6. Abuse Cases

OWASP A06:2025 — Insecure Design requires documenting abuse scenarios and controls.

AI Credit Farming

Attribute	Detail
Scenario	Multiple free-tier accounts exhaust AI credits without paying
Controls	Per-tier daily limits in `lib/config/pricing.ts`, `credits_used` tracking, edge rate limiting (60 req/min/IP)
Residual	Distributed farming across IPs (mitigate: email verification, CAPTCHA)

Support Ticket Spam

Attribute	Detail
Scenario	Bot/user floods support queue
Controls	Auth-only creation, rate limiting,`activity_logs` tracking
Residual	Auth spam within limits (mitigate: per-user ticket-per-hour cap)

Affiliate Fraud

Attribute	Detail
Scenario	Fake referral clicks, self-referrals, expired referral reuse, stale payout completion, or browser-fingerprint exposure
Controls	SHA-256 hashing for IP and user-agent values, tracking endpoint cookies, buyer-ID self-referral rejection, expiry checks, pending-only payouts
Residual	VPN-distributed fraud and collusive accounts (mitigate with manual review, payout thresholds, and provider-side payout holds)

Mass Enumeration

Attribute	Detail
Scenario	Probing login/signup for user existence
Controls	Generic errors, constant-time responses, edge rate limiting
Residual	Timing side-channels in OAuth (mitigate: constant-time rendering, aggressive limits)

Free Tier Abuse

Attribute	Detail
Scenario	Disproportionate compute/storage consumption
Controls	Feature flags gate premium features server-side, per-tier limits, pagination caps (100), validated upload MIME/size limits, MIME-derived object extensions
Residual	Heavy usage near boundaries (mitigate: usage dashboard, upgrade prompts)

Webhook Replay

Attribute	Detail
Scenario	Replaying valid webhook for duplicate payments
Controls	HMAC-SHA256, durable provider event IDs, `(provider, event_id)` partial unique index, success skip, active-processing skip, failed/stale retry, unique provider subscription/payment IDs
Residual	None — signature + dedup fully prevents replay

Threat Model (STRIDE)

Trust Boundaries

1. Authentication Flow

2. Payment Processing Flow

3. AI Chat Flow

4. ️ super-admin Panel Flow

5. Multi-Tenant Organization Flow

6. Abuse Cases

AI Credit Farming

Support Ticket Spam

Affiliate Fraud

Mass Enumeration

Free Tier Abuse

Webhook Replay

On this page

Skip the Boring Stuff. Ship your SaaS this Week with Vibe44.