# SECURITY.md — Haven > The self-attack checklist from `docs/THREAT_MODEL.md`, actually run — against a real running > app in a real browser and a real sync server, not just read from the source. Every item below > was executed on 2026-08-03 against the code at this commit; scripts are throwaway and not > checked into the repo, but the exact steps are described so any of this can be re-run. > > Note: at the time these checks ran, the app shell was `index.html`. It was later renamed to > `app.html` (Phase 8, when `index.html` became the marketing page so the custom domain's root > serves it) — every finding below still applies unchanged to `app.html`, only the filename moved. ## Results - [x] **XSS via task content** — Injected ``, `

`, `

`, never as live markup — `js/ui.js` renders exclusively via `textContent`, as designed. - [x] CSP bypass — Injected `` into `` at runtime. Both were blocked; the console logged real `Content-Security-Policy` violation reports for each. The inline script never executed (`window.__inlineRan` stayed `undefined`). - [x] IDOR on sync — Covered by `server/tests/test_sync.py::test_cross_token_isolation` and `test_keyring_bootstrap_cross_token_isolation`, re-run clean at commit time. Token B's push cannot read or overwrite token A's bucket. - [x] IV reuse — Encrypted the identical task object 20 times in a row with `encryptTask()`. All 20 IVs were unique (`crypto.getRandomValues(new Uint8Array(12))` per call, never a caller-supplied or derived IV — see `js/crypto.js`). - [x] Key-in-memory exposure — The DEK lives only in a module-scope `let dek` in `js/app.js`, as a non-extractable `CryptoKey`. Locking (`#lockBtn`) sets `dek = null`; a fresh `localStorage`/`sessionStorage` dump immediately after lock was empty in both. Nothing about the DEK is ever written to storage — only its wrapped form (via the passphrase- and recovery-derived KEKs) persists in IndexedDB's `keyring` store. - [x] Plaintext leak to storage — Added tasks with sensitive titles/notes, then read IndexedDB directly (bypassing the app's own code) via `indexedDB.open("haven")`. Stored records contain exactly `{id, iv, ciphertext, updatedAt}` — no plaintext field, and the payload text never appears anywhere in the raw dump. - [x] Plaintext leak to network — Added a task with an identifying secret title, enabled sync against the local server, and captured every request/response body Playwright saw on port 5050. The secret string and the passphrase never appeared in any request or response body across all 6 exchanges (push, pull, keyring push, keyring pull, and their responses). - [x] Tamper detection — Flipped one byte of a real ciphertext and attempted decryption with the correct DEK. `decryptTask()` threw — AES-GCM's authentication tag rejects any modification rather than returning corrupted plaintext. - [x] Wrong-passphrase behaviour — A deliberately wrong passphrase produces "Wrong passphrase.", clears the input, and leaves the app locked (`#mainWrap` stays hidden). The correct passphrase still works immediately afterward — no lockout, no corrupted state. Timing note: `deriveKek()` (the 600,000-iteration PBKDF2 step) always runs to completion before the cheap AES-GCM unwrap is attempted, on both the correct- and wrong-passphrase paths — so failure timing is dominated by the same fixed KDF cost either way, not a fast early-exit that would let an attacker distinguish "wrong passphrase" from "wrong KEK" via response time. - [x] Recovery-code entropy — `generateRecoveryCode()` draws 32 bytes (256 bits) from `crypto.getRandomValues`, never `Math.random`. Same for `generateSyncToken()` (also 32 bytes / 256 bits). Confirmed by reading `js/crypto.js` and `js/sync.js` directly — no other random-value call sites exist in either file. - [x] Deletion is real — Covered by `server/tests/test_sync.py::test_deletion_scrubs_ciphertext_not_just_flags_it`, re-run clean. `storage.py`'s `upsert_records` sets `iv`/`ciphertext` to `NULL` the moment a record is marked deleted — the tombstone row keeps only `id`/`updated_at`/`deleted`. - [x] Dependency audit — Zero `