# Threat model

Status: prototype threat model; requires independent security review before pilot.

## Assets

- Original medical document
- Rendered page pixels
- OCR text and token coordinates
- User redaction decisions
- Cleaned output document
- Verification report
- Application binaries, OCR models, and update channel

## Adversaries and failures

- Accidental disclosure by the patient
- A malicious or malformed PDF
- Malware on the local computer
- A compromised dependency or update
- A missed identifier due to OCR or rule failure
- A recoverable visual overlay instead of physical removal
- Hidden source objects copied into output
- Sensitive information in logs, metadata, filenames, thumbnails, or crash reports
- Re-identification through the MIKA account, exact dates, rare history, or external datasets
- Unauthorized staff access after upload

## Controls implemented in v0.2

- Source opened read-only and hash-checked after processing
- File size, page count, encryption, and image pixel limits
- No source overwrite
- OCR input passed over stdin rather than a persistent page-image temp file
- No detected text in exported analysis or verification reports
- No source PDF objects copied to output
- Fresh raster-only output
- Opaque pixel redaction with margin
- No output text layer, annotation, form, attachment, or active content
- Second render and second OCR/barcode scan
- Atomic release only after verification passes
- Missing Russian OCR or barcode capability blocks release
- Every page requires human confirmation
- Any change to a mask invalidates that page confirmation
- Application source carries NPO NT copyright and `AGPL-3.0-only` SPDX identifiers
- Source offer, third-party notices, and a direct-component SBOM are present in the source release

## Known open risks

| Risk | Current mitigation | Pilot requirement |
|---|---|---|
| Handwriting miss | Human page review | Representative validation and explicit rejection policy |
| Face or signature | Manual mask | Add detector or prove review usability |
| Malicious parser input | Size limits and safe rendering APIs | Restricted helper process, fuzzing, dependency review |
| Memory disclosure | No page temp file | OS/process hardening and secure crash configuration |
| OS thumbnails/recent files | Neutral output recommendation | Platform-specific privacy tests and packaging |
| Indirect re-identification | Policy and human review | Formal risk assessment for MIKA purpose and recipients |
| Account relinking | Explicit product warning | Separate identity/case architecture and legal basis |
| Update compromise | No updater in prototype | Signed installer and signed update manifest |
| Binary/source mismatch | Versioned source offer and direct SBOM | Reproducible build plus independently verified binary/source hash mapping |
| Patient data committed to public source | Explicit repository and contribution prohibition | Secret scanning, review controls, and incident process |
| Lost digital signature | Raster output warning | Keep source with patient; label output as navigation copy |

## Security invariants

- Never report success if a required local detector is absent.
- Never send the source or OCR text before an explicit user action.
- Never place patient identity, diagnosis, case number, or document content in a URL or analytics event.
- Never reuse a deterministic identity hash as the public case identifier.
- Never treat a cleaned document as safe for public release.
- Never introduce real patient data before the real-data release gate.
