24 lines
1.7 KiB
Markdown
24 lines
1.7 KiB
Markdown
# Threat model
|
||
|
||
TabBot’s secrets live on **this origin** and in the BridgeSwarm host. HoneyPeer is not a cloud vault. Full policy: [Legal → Security](/legal/security).
|
||
|
||
## Attackers we actually design for
|
||
|
||
| Threat | What happens | What you do |
|
||
| --- | --- | --- |
|
||
| XSS on this origin | Script reads IndexedDB, talks to BridgeSwarm as you | Treat the origin like a password manager. Do not inject untrusted HTML. Official site is `https://tab-bot.rest`. A self-host you publish is **your** XSS problem |
|
||
| Malicious share code / JSON | Hostile IR runs when the runner is up | Read the tree. Don’t launch first |
|
||
| Custom TypeScript | `main(client)` has the bot token’s power | Same as running discord.js on Node |
|
||
| Host-shell agent | QVAC agent can shell this machine and rewrite vault files/IR | You turned Agent mode on. Close Studio or the runner to stop the session |
|
||
| Hostile BridgeSwarm build | Sees Discord traffic | Install from the distribution you trust |
|
||
| Shared computer | Unlocked vault or “remember profile” wrapping key | Dedicated profile. Do not remember on a library PC |
|
||
| Shoulder surf / log leak | Token in a screenshot or log | Rotate in the Developer Portal |
|
||
|
||
Compromise of **your** laptop is not a HoneyPeer hosting incident. We never received the token.
|
||
|
||
## Tokens
|
||
|
||
Never in URLs, hashes, query strings, or logs. Handshake is same-origin `postMessage` + short-lived `sessionStorage` (token **and** named-secret bag). Share codes with a `token` field are rejected. Do not paste keys into Discord or [Community](/docs/guide/community).
|
||
|
||
See [Why tokens aren’t in URLs](/docs/security/tokens), [Named secrets](/docs/guide/named-secrets), and [Shared computer guidance](/docs/security/shared-computer).
|