a threat model in the repo that matches the code #48

New Issue

grenade · 2026-09-15T12:41:11Z

grenade commented

2026-09-15 12:41:11 +00:00

Parent: #10

Scope

doc/threat-model.md: assets (seed, keys, balances, addresses shown), trust boundaries (webview, Rust, relay, our nodes, Intents, ramp providers, the updater), what each compromise can and cannot do, and the mitigations by name (isolation pattern, capabilities, context-bound signing, address re-derivation on keystore open, minisign). Every mitigation names the file that implements it.

Acceptance

Reviewed against the code by someone who did not write it; a mitigation that names a file that no longer does that thing fails the review.

Depends on

#11 (isolation), #17 (session).

Parent: #10 ## Scope `doc/threat-model.md`: assets (seed, keys, balances, addresses shown), trust boundaries (webview, Rust, relay, our nodes, Intents, ramp providers, the updater), what each compromise can and cannot do, and the mitigations by name (isolation pattern, capabilities, context-bound signing, address re-derivation on keystore open, minisign). Every mitigation names the file that implements it. ## Acceptance Reviewed against the code by someone who did not write it; a mitigation that names a file that no longer does that thing fails the review. ## Depends on #11 (isolation), #17 (session).

grenade added the child label 2026-09-15 12:42:00 +00:00

grenade referenced this issue

2026-09-15 12:42:48 +00:00

epic: security hardening and release readiness #10

grenade referenced this issue from a commit

2026-09-16 07:14:46 +00:00

feat: the wormhole address behind mining rewards, and its shielded balance

grenade closed this issue

2026-09-16 07:14:46 +00:00

Sign in to join this conversation.