ERP-Unlocked Threat Model

Document Version: 2.1
Date: January 2025
Methodology: Microsoft STRIDE Framework with DREAD Risk Assessment
Scope: Complete ERP-Unlocked system including all services, third-party integrations, and CI/CD pipeline

Executive Summary

This threat model provides a comprehensive security analysis of the ERP-Unlocked platform, an AI-powered order processing system that automates PDF purchase order extraction and integrates with Prophet21 ERP systems. The analysis covers all owned services, third-party dependencies, and the complete development/deployment pipeline using Microsoft’s STRIDE methodology combined with DREAD risk assessment.

System Overview

ERP-Unlocked is a monorepo-based application that processes PDF purchase orders using AI, validates data against ERP systems, and enables streamlined order management workflows. The system handles sensitive business data including customer information, pricing, and order details.

Key Components

Frontend Applications: webapp (Astro/React), marketing (Astro)
Backend Services: pdf-api (FastAPI), pdf-worker (Celery)
Data Layer: PostgreSQL (Neon), Redis (Upstash in production)
External Services: Clerk Auth, Prophet21 ERP, Google Gemini AI, Cloudflare R2, BetterStack, Trigger.dev
AI Development Tools: Cursor, Devin AI, CodeRabbit (with repository access and PR creation capabilities)

Risk Assessment Methodology

This threat model uses a combination of STRIDE threat categorization and DREAD risk scoring to provide standardized risk assessment across all identified threats.

DREAD Risk Scoring Framework

Each threat is scored on a scale of 1-10 across five dimensions:

Damage (D): How severe would the impact be if the threat occurred?
Reproducibility (R): How easy is it to reproduce the attack?
Exploitability (E): How much work is required to launch the attack?
Affected Users (A): How many users would be impacted?
Discoverability (Di): How easy is it to discover the vulnerability?

Overall Risk Score = (D + R + E + A + Di) / 5

Risk Levels

Critical (8.5-10.0): Immediate action required
High (7.0-8.4): Address within 30 days
Medium (5.0-6.9): Address within 90 days
Low (3.0-4.9): Address within 180 days
Minimal (1.0-2.9): Monitor and review annually

Trust Boundaries

The system is organized into distinct security zones with defined trust boundaries:

graph TB
    subgraph "Internet Zone"
        U[Users/Browsers]
        A[Attackers]
    end

    subgraph "CDN/Edge Zone"
        CF[Cloudflare]
        CFP[Cloudflare Pages]
    end

    subgraph "Authentication Zone"
        CL[Clerk Auth Service]
    end

    subgraph "Application Zone (Public)"
        WA[webapp:4321]
    end

    subgraph "Internal Service Zone (Private Network)"
        PA[pdf-api:8000]
        PW[pdf-worker]
    end

    subgraph "Data Zone"
        DB[(PostgreSQL/Neon)]
        R2[Cloudflare R2 Storage]
    end

    subgraph "External Services Zone"
        ERP[Customer's ERP System]
        GEM[Google Gemini AI]
        BS[BetterStack Observability]
        TD[Trigger.dev]
        RS[Resend Email]
        R[Redis/Upstash]
        GH_API[GitHub API]
    end

    subgraph "Development Zone"
        GH[GitHub Repository]
        GA[GitHub Actions]
        GHCR[GitHub Container Registry]
        CO[Coolify Deployment]
    end

    subgraph "AI Development Tools Zone"
        CUR[Cursor AI]
        DEV[Devin AI]
        CR[CodeRabbit]
    end

    U --> CF
    CF --> WA
    CF --> CFP
    WA --> CL
    WA --> PA
    WA --> DB
    WA --> R2
    WA --> ERP
    WA --> RS
    WA --> GH_API
    PA --> PW
    PA --> R
    PW --> R
    PA --> DB
    PW --> DB
    PA --> R2
    PW --> R2
    PW --> GEM
    WA --> BS
    PA --> BS
    PW --> BS
    WA --> TD
    TD --> R2
    TD --> ERP
    TD --> R

    GH --> GA
    GA --> GHCR
    GA --> CO
    CO --> WA
    CO --> PA
    CO --> PW

    CUR --> GH
    DEV --> GH
    CR --> GH

Service-Specific Architecture Diagrams

Webapp Service Architecture

graph TB
    subgraph "Webapp Service (Port 4321)"
        WA_UI[Astro/React UI]
        WA_API[API Routes]
        WA_ACTIONS[Server Actions]
        WA_MIDDLEWARE[Auth Middleware]
        WA_TRIGGER[Trigger.dev Jobs]
        WA_R2[R2 Client]
    end

    subgraph "External Dependencies"
        CL[Clerk Auth]
        DB[(PostgreSQL/Neon)]
        R[Redis/Upstash]
        ERP[Customer's ERP System]
        BS[BetterStack]
        TD[Trigger.dev]
        R2[Cloudflare R2]
        RS[Resend Email]
        GH_API[GitHub API]
        PA[pdf-api - Internal]
    end

    WA_UI --> WA_API
    WA_UI --> WA_ACTIONS
    WA_API --> WA_MIDDLEWARE
    WA_ACTIONS --> WA_MIDDLEWARE
    WA_MIDDLEWARE --> CL
    WA_API --> DB
    WA_ACTIONS --> DB
    WA_TRIGGER --> DB
    WA_API --> R
    WA_TRIGGER --> R
    WA_API --> ERP
    WA_API --> BS
    WA_TRIGGER --> TD
    WA_API --> WA_R2
    WA_TRIGGER --> WA_R2
    WA_R2 --> R2
    WA_API --> RS
    WA_API --> GH_API
    WA_API --> PA

PDF API Service Architecture

graph TB
    subgraph "PDF API Service (Port 8000 - Internal Only)"
        PA_MAIN[FastAPI App]
        PA_AUTH[Service Token Auth]
        PA_UPLOAD[Upload Handler]
        PA_PROCESS[Processing Logic]
        PA_QUEUE[Job Queue]
        PA_STORAGE[File Storage]
    end

    subgraph "External Dependencies"
        DB[(PostgreSQL/Neon)]
        R[Redis/Upstash]
        R2[Cloudflare R2]
        BS[BetterStack]
        WA[webapp - Service Token]
        PW[pdf-worker - via Redis]
    end

    WA --> PA_AUTH
    PA_AUTH --> PA_MAIN
    PA_MAIN --> PA_UPLOAD
    PA_MAIN --> PA_PROCESS
    PA_UPLOAD --> PA_STORAGE
    PA_PROCESS --> PA_QUEUE
    PA_STORAGE --> R2
    PA_PROCESS --> DB
    PA_QUEUE --> R
    PA_QUEUE --> PW
    PA_MAIN --> SIG

PDF Worker Service Architecture

graph TB
    subgraph "PDF Worker Service"
        PW_CELERY[Celery Worker]
        PW_TASKS[Processing Tasks]
        PW_EXTRACT[AI Extraction]
        PW_VALIDATE[Data Validation]
        PW_STORE[Data Storage]
    end

    subgraph "External Dependencies"
        DB[(PostgreSQL/Neon)]
        R[Redis/Upstash]
        R2[Cloudflare R2]
        GEM[Google Gemini AI]
        BS[BetterStack]
    end

    PW_CELERY --> PW_TASKS
    PW_TASKS --> PW_EXTRACT
    PW_TASKS --> PW_VALIDATE
    PW_TASKS --> PW_STORE
    PW_EXTRACT --> GEM
    PW_VALIDATE --> DB
    PW_STORE --> DB
    PW_STORE --> R2
    PW_CELERY --> R
    PW_CELERY --> SIG

ERP Sync Service Architecture (Trigger.dev Jobs)

graph TB
    subgraph "ERP Sync Trigger Jobs"
        TD_SYNC[ERP Entity Sync]
        TD_HEALTH[Health Check]
        TD_PRICING[Customer Pricing]
        TD_IMAGES[Product Images]
        TD_CLEANUP[Data Cleanup]
        TD_VERIFY[Sync Verification]
    end

    subgraph "ERP Sync Components"
        SF[Sync Factory]
        SS[Sync Service]
        SV[Sync Validation]
        ERF[ERP Service Factory]
        ES[ERP Service Implementation]
    end

    subgraph "External Dependencies"
        DB[(PostgreSQL/Neon)]
        ERP[Customer's ERP System]
        R2[Cloudflare R2]
        BS[BetterStack]
    end

    TD_SYNC --> SF
    TD_HEALTH --> SF
    TD_PRICING --> SF
    SF --> SS
    SS --> SV
    SS --> ERF
    ERF --> ES
    ES --> ERP
    SS --> DB
    TD_IMAGES --> R2
    TD_CLEANUP --> DB
    TD_VERIFY --> DB
    TD_VERIFY --> ERP
    TD_SYNC --> SIG

System Architecture & Data Flow

Primary Data Flows

sequenceDiagram
    participant U as User
    participant WA as webapp
    participant CL as Clerk
    participant PA as pdf-api
    participant PW as pdf-worker
    participant R as Redis/Upstash
    participant DB as PostgreSQL/Neon
    participant R2 as R2 Storage
    participant ERP as Customer's ERP System
    participant GEM as Gemini AI
    participant TD as Trigger.dev
    participant GH_API as GitHub API

    Note over U,TD: Authentication Flow
    U->>WA: Access application
    WA->>CL: Validate JWT token
    CL-->>WA: User profile + roles

    Note over U,TD: PDF Upload Flow (Direct to R2)
    U->>WA: Upload PDF order
    WA->>WA: Generate R2 signed URL
    WA-->>U: Return signed URL
    U->>R2: Upload PDF directly
    WA->>DB: Create document record
    WA->>PA: Trigger processing (X-Service-Token)
    PA->>R: Queue extraction job
    R->>PW: Process extraction task
    PW->>R2: Fetch PDF file
    PW->>GEM: Extract order data
    GEM-->>PW: Structured order data
    PW->>DB: Store extracted order

    Note over U,TD: Thumbnail Generation Flow
    WA->>TD: Trigger thumbnail job
    TD->>R2: Fetch PDF file
    TD->>TD: Generate thumbnail
    TD->>R2: Upload thumbnail
    TD->>DB: Update thumbnail reference

    Note over U,TD: ERP Integration Flow
    U->>WA: Validate order items
    WA->>ERP: Query product catalog
    ERP-->>WA: Product data
    WA->>DB: Cache ERP data

    Note over U,TD: ERP Data Sync Flow (Trigger.dev)
    WA->>TD: Schedule ERP sync jobs
    TD->>TD: Execute syncERPEntity task
    TD->>DB: Fetch ERP connection config
    TD->>ERP: Sync products/customers/cross-references
    ERP-->>TD: Bulk entity data
    TD->>DB: Validate and store synced data
    TD->>R2: Store product images (if applicable)
    TD->>SIG: Log sync metrics and health

    Note over U,TD: Support Ticket Flow
    U->>WA: Report error/request help
    WA->>WA: Sanitize sensitive data
    WA->>GH_API: Create GitHub Issue
    GH_API-->>WA: Issue confirmation
    WA->>DB: Log support ticket

    Note over U,TD: Order Submission Flow
    U->>WA: Submit order
    WA->>ERP: Create ERP order
    ERP-->>WA: Order confirmation
    WA->>DB: Update order status

Service Authentication Patterns

graph TB
    subgraph "Authentication Flows"
        U[User Browser]
        WA[webapp]
        PA[pdf-api]
        CL[Clerk Auth]

        U -->|JWT Token| WA
        WA -->|Validate JWT| CL
        WA -->|X-Service-Token| PA

        style PA fill:#ffebee
        style WA fill:#e8f5e8
    end

    subgraph "Network Isolation"
        PUB[Public Network]
        PRIV[Private Network]

        WA -.->|Exposed| PUB
        PA -.->|Internal Only| PRIV

        style PRIV fill:#fff3e0
        style PUB fill:#e3f2fd
    end

AI Development Tools Access

Repository Access and Capabilities

The following AI development tools have been granted access to the ERP-Unlocked codebase and possess the ability to create Pull Requests:

Cursor AI
- Access Level: Full repository access
- Capabilities: Code analysis, refactoring, PR creation
- Security Considerations: Can read all source code, environment configurations, and documentation
Devin AI
- Access Level: Full repository access
- Capabilities: Autonomous development, testing, PR creation
- Security Considerations: Can execute code, access development environments, create and modify files
CodeRabbit
- Access Level: Full repository access
- Capabilities: Code review, automated suggestions, PR creation
- Security Considerations: Can analyze code changes, suggest improvements, create review PRs

Security Implications

Threats:

Code Exposure: AI tools can access sensitive business logic, API endpoints, and configuration patterns
Credential Exposure: Environment variables and secrets may be visible in code or documentation
Architecture Analysis: System design and security patterns can be analyzed and potentially exploited
Automated Attacks: Malicious code could be introduced through AI-generated PRs

Mitigations:

Branch Protection: All PRs require human review before merging
Secret Scanning: GitHub secrets scanning prevents accidental credential exposure
Code Review Process: Mandatory human review of all AI-generated changes
Environment Isolation: Production credentials are never exposed to development tools
Access Logging: All repository access is logged and monitored

STRIDE Threat Analysis

1. Spoofing Threats

1.1 Authentication Bypass

Component: Clerk JWT Validation
Threat: Attacker forges or bypasses JWT tokens to impersonate legitimate users
Impact: Unauthorized access to sensitive order data and ERP systems
DREAD Score: D=9, R=4, E=6, A=8, Di=5 = 6.4 (Medium)
Current Mitigations:

JWKS-based token verification in clerk-server.ts
Multiple cookie pattern validation
Rate limiting on authentication failures
Session token validation on each request

Recommended Mitigations:

Implement JWT token rotation
Add IP-based anomaly detection
Strengthen session management with shorter token lifetimes

1.2 Service Token Spoofing

Component: pdf-api Service Authentication
Threat: Attacker spoofs X-Service-Token header to bypass internal service authentication
Impact: Unauthorized access to PDF processing APIs
DREAD Score: D=7, R=6, E=5, A=6, Di=4 = 5.6 (Medium)
Current Mitigations:

Static service token validation in middleware.py
Token stored in environment variables

Recommended Mitigations:

Implement rotating service tokens
Add mutual TLS for service-to-service communication
Network-level access controls

1.3 ERP System Impersonation

Component: Customer’s ERP System Integration
Threat: Attacker impersonates ERP system to inject malicious data
Impact: Corrupted business data, fraudulent orders
DREAD Score: D=8, R=3, E=7, A=7, Di=4 = 5.8 (Medium)
Current Mitigations:

Bearer token authentication to ERP systems
HTTPS-only communication
Input validation and sanitization

Recommended Mitigations:

Certificate pinning for ERP connections
API response integrity validation
Anomaly detection on ERP data patterns

1.4 ERP Sync Job Impersonation

Component: Trigger.dev ERP Sync Jobs
Threat: Attacker triggers unauthorized ERP sync operations or spoofs sync jobs
Impact: Data corruption, unauthorized ERP access, resource exhaustion
DREAD Score: D=7, R=5, E=6, A=7, Di=5 = 6.0 (Medium)
Current Mitigations:

Trigger.dev authentication and authorization
ERP connection validation before sync
Concurrency limits on sync jobs

Recommended Mitigations:

Enhanced job authentication mechanisms
Sync job approval workflows for critical operations
Rate limiting on sync job execution
Sync operation audit logging

1.5 Internal Network Lateral Movement

Component: Docker Container Network & Internal Service Communication
Threat: Attacker compromises one container and moves laterally to access other internal services like pdf-api or Redis
Impact: Unauthorized access to internal APIs, data exfiltration, service compromise
DREAD Score: D=8, R=4, E=7, A=6, Di=6 = 6.2 (Medium)
Current Mitigations:

Docker network isolation between services
Service token authentication for pdf-api
No external port exposure for internal services
Container resource constraints

Recommended Mitigations:

Network micro-segmentation between containers
Zero-trust network architecture for internal services
Container-to-container authentication mechanisms
Network traffic monitoring and anomaly detection
Principle of least privilege for container network access

2. Tampering Threats

2.1 PDF Content Manipulation

Component: PDF Upload & Processing
Threat: Attacker uploads malicious PDFs to exploit processing vulnerabilities
Impact: Code execution, data corruption, system compromise
DREAD Score: D=8, R=6, E=5, A=6, Di=7 = 6.4 (Medium)
Current Mitigations:

File type validation
Cloudflare R2 storage isolation
Celery worker sandboxing

Recommended Mitigations:

PDF content sanitization
Virus scanning integration
Container-based processing isolation
File size and complexity limits

2.2 Database Injection

Component: PostgreSQL Database Access
Threat: SQL injection through user inputs or API parameters
Impact: Data breach, data corruption, privilege escalation
DREAD Score: D=9, R=3, E=4, A=8, Di=5 = 5.8 (Medium)
Current Mitigations:

Drizzle ORM with parameterized queries
Input sanitization in prophet21-service.ts
Database connection pooling with limits

Recommended Mitigations:

Database activity monitoring
Principle of least privilege for database users
Regular security audits of database queries

2.3 CI/CD Pipeline Tampering

Component: GitHub Actions & Deployment
Threat: Attacker compromises CI/CD pipeline to inject malicious code
Impact: Supply chain attack, production system compromise
DREAD Score: D=10, R=3, E=6, A=9, Di=4 = 6.4 (Medium)
Current Mitigations:

Branch protection rules
Required PR reviews
Secrets management in GitHub
Webhook-based deployments

Recommended Mitigations:

Signed commits requirement
Container image scanning
Deployment approval workflows
Infrastructure as Code validation

2.4 Service Token Tampering

Component: webapp to pdf-api Communication
Threat: Attacker compromises PDF_PROCESSOR_TOKEN to tamper with pdf-api requests
Impact: Unauthorized access to internal APIs, data manipulation
DREAD Score: D=7, R=5, E=5, A=6, Di=6 = 5.8 (Medium)
Current Mitigations:

Static service token validation
Network isolation (pdf-api not exposed to internet)
Environment variable protection

Recommended Mitigations:

Token rotation mechanism
Replace service tokens with Clerk-based authentication
Mutual TLS for service communication
Request signing and validation

2.5 Direct R2 Upload Tampering

Component: Client-side R2 Upload
Threat: Attacker manipulates signed URLs or uploads malicious content directly to R2
Impact: Malicious file upload, storage abuse, potential code execution
DREAD Score: D=7, R=6, E=4, A=5, Di=7 = 5.8 (Medium)
Current Mitigations:

Pre-signed URL expiration (1 hour)
Content-Type validation
File size limits in signed URLs

Recommended Mitigations:

Server-side file validation after upload
Virus scanning on uploaded files
Content inspection before processing
Rate limiting on signed URL generation

2.6 ERP Sync Data Tampering

Component: ERP Data Synchronization Process
Threat: Attacker manipulates ERP sync data during transfer or storage
Impact: Corrupted product catalogs, pricing manipulation, inventory discrepancies
DREAD Score: D=8, R=4, E=6, A=7, Di=5 = 6.0 (Medium)
Current Mitigations:

HTTPS encryption for ERP API calls
Database transaction integrity
Sync validation and health checks
Business validation rules

Recommended Mitigations:

Data integrity checksums for sync payloads
Encrypted storage for sensitive ERP data
Real-time sync anomaly detection
Backup and rollback mechanisms for sync operations

2.7 Support Ticket Data Tampering

Component: GitHub API Support Tickets
Threat: Attacker manipulates support ticket data or GitHub API responses
Impact: False support tickets, data corruption, unauthorized access to customer information
DREAD Score: D=6, R=5, E=5, A=6, Di=6 = 5.6 (Medium)
Current Mitigations:

GitHub API authentication and authorization
Rate limiting on ticket creation
Request validation and sanitization

Recommended Mitigations:

Support ticket integrity validation
Audit logging for all GitHub API interactions
Implement ticket verification workflows
Monitor for unusual ticket patterns

2.8 AI Tool Generated Malicious Code

Component: AI Development Tools
Threat: AI tools generate or suggest malicious code that gets merged
Impact: Backdoor insertion, data exfiltration, system compromise
DREAD Score: D=9, R=4, E=5, A=8, Di=5 = 6.2 (Medium)
Current Mitigations:

Mandatory human code review
Branch protection rules
Automated security scanning

Recommended Mitigations:

AI-generated code validation tools
Enhanced static analysis for AI-generated code
Security-focused code review checklists
Regular security training for reviewers

2.9 Compromised Package Dependencies

Component: npm/Python Package Dependencies in Build Pipeline
Threat: Attacker compromises upstream packages or introduces malicious dependencies through package updates
Impact: Supply chain attack, backdoor insertion, credential theft, system compromise
DREAD Score: D=9, R=5, E=6, A=8, Di=6 = 6.8 (Medium)
Current Mitigations:

Package-lock.json and poetry.lock for dependency pinning
GitHub Dependabot security alerts
Automated dependency updates with PR reviews
Container image scanning in CI/CD

Recommended Mitigations:

Software Composition Analysis (SCA) tools
Package signature verification
Dependency vulnerability scanning in CI/CD
Regular dependency audits and updates
Private package registry for critical dependencies

2.10 Malicious Package Installation

Component: Development Environment & CI/CD Pipeline
Threat: Malicious packages installed through typosquatting, dependency confusion, or compromised package repositories
Impact: Development environment compromise, credential theft, code injection
DREAD Score: D=8, R=6, E=5, A=7, Di=7 = 6.6 (Medium)
Current Mitigations:

Locked dependency versions in package files
GitHub Actions environment isolation
Code review for dependency changes
Container-based build environments

Recommended Mitigations:

Package name verification and allowlisting
Private package mirrors for critical dependencies
Dependency integrity checks and checksums
Regular security scanning of development environments
Network segmentation for build environments

2.11 Service Mesh Vulnerabilities

Component: Docker Container Communication & Service Discovery
Threat: Compromised containers exploit service mesh vulnerabilities to tamper with inter-service communication
Impact: Data manipulation in transit, service impersonation, communication interception
DREAD Score: D=7, R=3, E=6, A=6, Di=4 = 5.2 (Medium)
Current Mitigations:

Docker network isolation
HTTPS/TLS for external communications
Service token validation for pdf-api
Container image security scanning

Recommended Mitigations:

Mutual TLS (mTLS) for all inter-service communication
Service mesh security policies and access controls
Regular security updates for container runtime
Network traffic encryption and integrity validation
Service identity verification mechanisms

2.12 Redis Queue Poisoning

Component: Redis Queue & pdf-worker Task Processing
Threat: Attacker injects malicious tasks into Redis queues to manipulate pdf-worker processing
Impact: Malicious PDF processing, resource exhaustion, data corruption
DREAD Score: D=7, R=5, E=5, A=6, Di=6 = 5.8 (Medium)
Current Mitigations:

Redis password authentication
Network isolation for Redis access
Celery task validation in pdf-worker
Container resource limits

Recommended Mitigations:

Task payload validation and sanitization
Redis access control lists (ACLs) for fine-grained permissions
Task signing and integrity verification
Queue monitoring and anomaly detection
Separate Redis instances for different task types

2.13 Backup Data Tampering

Component: Neon PostgreSQL Backups & Cloudflare R2 Storage
Threat: Attacker compromises backup systems to tamper with or corrupt backup data, preventing reliable recovery
Impact: Data integrity loss, inability to recover from incidents, business continuity failure
DREAD Score: D=8, R=2, E=7, A=8, Di=3 = 5.6 (Medium)
Current Mitigations:

Neon automated backup encryption
Cloudflare R2 versioning and immutability features
Access controls on backup storage
Backup integrity verification

Recommended Mitigations:

Backup data signing and cryptographic verification
Immutable backup storage with write-once policies
Regular backup integrity testing and validation
Separate backup storage credentials and access controls
Backup tampering detection and alerting mechanisms

2.14 Log Injection and Audit Trail Manipulation

Component: BetterStack Observability Platform & Application Logging
Threat: Attacker injects malicious log entries or manipulates audit trails to hide malicious activities or create false evidence
Impact: Compromised incident response, false audit trails, inability to detect security breaches, compliance violations
DREAD Score: D=7, R=5, E=4, A=6, Di=6 = 5.6 (Medium)
Current Mitigations:

Structured logging with consistent formats
Centralized log collection in BetterStack
Log entry validation and sanitization
Access controls on logging infrastructure

Recommended Mitigations:

Log entry signing and cryptographic integrity verification
Immutable log storage with tamper detection
Real-time log anomaly detection and alerting
Separate logging infrastructure with restricted access
Log correlation and cross-validation mechanisms

2.15 Malicious Container Images in GHCR

Component: GitHub Container Registry & Container Image Storage
Threat: Attacker compromises GHCR or injects malicious container images that get deployed to production environments
Impact: Code execution in production, backdoor installation, data exfiltration, service compromise
DREAD Score: D=9, R=3, E=6, A=8, Di=4 = 6.0 (Medium)
Current Mitigations:

GitHub Actions OIDC token authentication
Container image vulnerability scanning
Private container registry access controls
Signed container images (if implemented)

Recommended Mitigations:

Container image signing and verification with Cosign
Multi-stage image scanning and validation
Container image provenance tracking and attestation
Registry access monitoring and anomaly detection
Immutable image tags and content addressable storage

2.16 Container Image Tampering During CI/CD Pipeline

Component: GitHub Actions CI/CD Pipeline & Container Build Process
Threat: Attacker compromises CI/CD pipeline to tamper with container images during build or deployment process
Impact: Malicious code injection, compromised deployments, supply chain attacks, production system compromise
DREAD Score: D=9, R=3, E=6, A=8, Di=5 = 6.2 (Medium)
Current Mitigations:

GitHub Actions workflow security controls
OIDC token-based authentication
Workflow approval requirements
Container build environment isolation

Recommended Mitigations:

Build process integrity verification and attestation
Secure build environments with ephemeral runners
Multi-party approval for production deployments
Build artifact signing and chain of custody tracking
Real-time monitoring of CI/CD pipeline activities

3. Repudiation Threats

3.1 Order Processing Audit Trail

Component: Order Management System
Threat: Users deny placing orders or making changes
Impact: Business disputes, compliance violations
DREAD Score: D=6, R=7, E=3, A=7, Di=5 = 5.6 (Medium)
Current Mitigations:

BetterStack observability platform
Structured logging across services
Database transaction logs

Recommended Mitigations:

Comprehensive audit logging with immutable storage
Digital signatures for critical actions (order submission, approval, modification)
User action timestamping with cryptographic proof
Before/after state logging for all order modifications
Order lifecycle event tracking with user attribution

Critical Actions Requiring Non-Repudiation:

Order submission with complete order details and user identity
Order status changes (draft → submitted → approved → processed)
Pricing modifications or overrides
Customer information updates
Payment processing initiation
Order cancellation or refund requests

3.2 ERP Integration Logging

Component: Prophet21 ERP Communication
Threat: Denial of ERP system interactions or data modifications
Impact: Data integrity disputes, compliance issues
DREAD Score: D=7, R=6, E=3, A=6, Di=4 = 5.2 (Medium)
Current Mitigations:

API request/response logging
Error tracking and monitoring
Transaction correlation IDs

Recommended Mitigations:

End-to-end transaction logging with cryptographic integrity
ERP system audit integration and cross-validation
Cryptographic proof of interactions with request/response signing
Immutable audit trail for all ERP data synchronization operations
Time-stamped records of all ERP entity modifications (products, customers, pricing)

Critical ERP Actions Requiring Non-Repudiation:

Product catalog synchronization with before/after state
Customer data updates and new customer creation
Pricing changes and customer-specific pricing modifications
Inventory level updates and availability changes
Order submission to ERP system with full order payload
ERP system configuration changes

3.3 Administrative Action Accountability

Component: Admin Panel & User Management
Threat: Administrators deny performing sensitive administrative actions
Impact: Internal security breaches, unauthorized system changes, compliance violations
DREAD Score: D=8, R=5, E=2, A=6, Di=3 = 4.8 (Low)
Current Mitigations:

Clerk role-based authentication
Admin-only endpoint protection
Basic activity logging

Recommended Mitigations:

Multi-factor authentication requirement for all admin actions
Digital signatures for critical administrative changes
Immutable audit trail for user permission modifications
Before/after state logging for all configuration changes
Secondary approval requirement for high-risk admin actions

Critical Admin Actions Requiring Non-Repudiation:

User role and permission changes
ERP connection configuration modifications
System configuration changes (API keys, integration settings)
Data export or bulk operations
Security policy modifications
Emergency system access or override actions

3.4 AI Development Tool Actions

Component: AI Development Tools & Code Modifications
Threat: Denial of AI tool actions or code changes made through automated tools
Impact: Unauthorized code changes, security vulnerabilities, development process integrity
DREAD Score: D=7, R=4, E=3, A=7, Di=4 = 5.0 (Medium)
Current Mitigations:

GitHub commit history and attribution
Branch protection rules requiring human review
Pull request approval workflows

Recommended Mitigations:

Enhanced logging of all AI tool interactions with the codebase
Cryptographic signing of AI-generated code changes
Detailed audit trail of AI tool decision-making processes
Human verification and digital approval for AI-generated changes
Immutable record of AI tool access patterns and activities

Critical AI Tool Actions Requiring Non-Repudiation:

Code generation and modification suggestions
Pull request creation and automated commits
Security vulnerability remediation actions
Dependency updates and package modifications
Configuration file changes
Database migration or schema modification suggestions

4. Information Disclosure Threats

4.1 Sensitive Data Exposure

Component: Environment Variables & Configuration
Threat: Exposure of API keys, database credentials, and encryption keys
Impact: Complete system compromise, data breach
DREAD Score: D=10, R=5, E=4, A=9, Di=6 = 6.8 (Medium)
Current Mitigations:

Environment variable isolation
GitHub Secrets management
Encrypted environment files

Recommended Mitigations:

Secrets rotation automation
Runtime secrets scanning
Principle of least privilege for secrets access
Secrets encryption at rest

4.2 Customer Data Leakage

Component: Database & API Responses
Threat: Unauthorized access to customer information and order data
Impact: Privacy violations, regulatory compliance issues
DREAD Score: D=9, R=4, E=5, A=8, Di=6 = 6.4 (Medium)
Current Mitigations:

Role-based access control
Database connection encryption
API response filtering

Recommended Mitigations:

Data classification and labeling
Field-level encryption for PII
Data loss prevention (DLP) tools
Regular access reviews

4.3 ERP System Data Exposure

Component: Customer’s ERP System Integration
Threat: Exposure of ERP credentials or sensitive business data
Impact: Business intelligence theft, competitive disadvantage
DREAD Score: D=8, R=3, E=5, A=7, Di=5 = 5.6 (Medium)
Current Mitigations:

Credential masking in logs
HTTPS-only communication
Limited data caching

Recommended Mitigations:

ERP data encryption in transit and at rest
API response data minimization
Regular credential rotation
Network segmentation

4.4 Trigger.dev Data Access

Component: Trigger.dev Jobs
Threat: Trigger.dev jobs have broad access to sensitive data and external services
Impact: Data exfiltration, unauthorized service access
DREAD Score: D=7, R=5, E=4, A=6, Di=6 = 5.6 (Medium)
Current Mitigations:

Environment variable isolation
Job-specific permissions
Audit logging

Recommended Mitigations:

Principle of least privilege for Trigger jobs
Separate credentials for different job types
Enhanced monitoring of Trigger job activities
Data access restrictions per job function

4.5 Network Boundary Bypass

Component: Internal Service Network
Threat: Attacker bypasses network isolation to access pdf-api directly
Impact: Unauthorized access to internal APIs, service compromise
DREAD Score: D=7, R=3, E=6, A=5, Di=4 = 5.0 (Medium)
Current Mitigations:

Docker network isolation
No external port exposure for pdf-api
Service token authentication

Recommended Mitigations:

Network segmentation monitoring
Intrusion detection systems
Zero-trust network architecture
Regular network security audits

4.6 Email Service Data Exposure

Component: Resend Email Service
Threat: Sensitive information exposed through email content or logs
Impact: Data leakage through support tickets, contact forms, and alert emails
DREAD Score: D=6, R=5, E=4, A=5, Di=6 = 5.2 (Medium)
Current Mitigations:

HTTPS encryption for email API calls
Sanitized payloads in alert emails
Domain-based email authentication

Recommended Mitigations:

Email content sanitization and validation
PII detection and masking in email content
Secure email storage and retention policies
Regular audit of email logs and content

4.7 GitHub API Data Exposure

Component: GitHub API Support Tickets
Threat: Sensitive customer data exposed through GitHub Issues containing order details, error contexts, and user information
Impact: Customer data breach, business intelligence exposure, compliance violations
DREAD Score: D=9, R=7, E=3, A=7, Di=8 = 6.8 (Medium)
Current Mitigations:

Data sanitization patterns for sensitive fields
Rate limiting on ticket creation
Private repository storage
JWT token detection and redaction

Recommended Mitigations:

Enhanced PII detection and masking
Encrypt sensitive data before GitHub storage
Regular audit of GitHub issue content
Implement data retention policies for support tickets
Consider alternative support ticket systems with better data controls

4.8 AI Tool Data Exposure

Component: AI Development Tools
Threat: Sensitive code or configuration exposed to AI tools
Impact: Business logic exposure, security pattern analysis
DREAD Score: D=8, R=8, E=2, A=7, Di=7 = 6.4 (Medium)
Current Mitigations:

Environment variable protection
Secrets management
Code review processes

Recommended Mitigations:

AI tool access restrictions
Sensitive data detection in code
Regular access audits
Data classification for AI tools

4.9 Data Residency Compliance Violations

Component: Cloudflare R2 Storage & Neon PostgreSQL
Threat: Customer data stored in geographic regions that violate data residency requirements or compliance regulations
Impact: Regulatory fines, legal liability, customer contract violations, business license revocation
DREAD Score: D=8, R=4, E=3, A=6, Di=5 = 5.2 (Medium)
Current Mitigations:

Cloudflare R2 regional storage configuration
Neon PostgreSQL regional deployment
Data classification policies
Customer data handling procedures

Recommended Mitigations:

Automated data residency validation and monitoring
Customer-specific data location controls
Regular compliance audits and certifications
Data sovereignty impact assessments
Geographic data mapping and tracking

4.10 Cross-Border ERP Data Transfer Violations

Component: Prophet21 ERP Integration & Customer Data Sync
Threat: Cross-border data transfers between ERP systems and cloud services violate international data protection laws
Impact: GDPR violations, regulatory sanctions, customer data breach notifications, international legal disputes
DREAD Score: D=9, R=6, E=3, A=7, Di=5 = 6.0 (Medium)
Current Mitigations:

HTTPS encryption for ERP communications
Limited ERP data caching and storage
Customer consent mechanisms
Data processing agreements

Recommended Mitigations:

Data transfer impact assessments (DPIA)
Standard contractual clauses (SCCs) for international transfers
Data localization options for sensitive customers
Real-time data transfer monitoring and logging
Automated compliance validation for cross-border flows

4.11 Audit Trail Compliance Gaps

Component: BetterStack Observability & Database Logging
Threat: Insufficient audit trails and logging gaps prevent compliance with regulatory requirements for data access and processing
Impact: Compliance violations, failed audits, inability to demonstrate data protection controls, regulatory penalties
DREAD Score: D=7, R=5, E=2, A=6, Di=4 = 4.8 (Low)
Current Mitigations:

BetterStack centralized logging and monitoring
Database transaction logging
API request/response logging
User action tracking

Recommended Mitigations:

Comprehensive audit trail requirements mapping
Immutable audit log storage with tamper detection
Real-time compliance monitoring and alerting
Automated audit report generation
Long-term audit data retention and archival policies

4.12 Backup Data Exposure During Recovery

Component: Neon PostgreSQL Recovery & Cloudflare R2 Restore Operations
Threat: Sensitive data exposed during backup recovery processes through insecure recovery procedures or temporary storage
Impact: Data breach during recovery, unauthorized access to historical data, compliance violations
DREAD Score: D=8, R=3, E=5, A=6, Di=4 = 5.2 (Medium)
Current Mitigations:

Encrypted backup storage in Neon and R2
Access controls on recovery operations
Secure recovery environment isolation
Recovery process documentation and procedures

Recommended Mitigations:

End-to-end encryption for recovery data flows
Secure recovery environment with network isolation
Recovery process audit logging and monitoring
Temporary data cleanup and secure deletion procedures
Recovery access approval workflows and multi-person authorization

4.13 Incomplete Recovery Data Integrity Issues

Component: Database Recovery & ERP Data Synchronization
Threat: Incomplete or partial recovery operations lead to data integrity issues and inconsistencies between systems
Impact: Data corruption, business process failures, ERP synchronization errors, customer order processing issues
DREAD Score: D=7, R=4, E=3, A=7, Di=5 = 5.2 (Medium)
Current Mitigations:

Neon point-in-time recovery capabilities
ERP sync job validation and health checks
Database transaction consistency checks
Recovery testing and validation procedures

Recommended Mitigations:

Automated recovery validation and integrity verification
Cross-system data consistency checks post-recovery
Recovery rollback mechanisms for failed operations
Real-time monitoring of data integrity during recovery
Comprehensive recovery testing with production-like data

4.14 BetterStack Observability Platform Compromise

Component: BetterStack Observability & Telemetry Data
Threat: Compromise of BetterStack platform exposes sensitive telemetry data, system metrics, and operational intelligence
Impact: Business intelligence exposure, system architecture disclosure, performance data leakage, operational security compromise
DREAD Score: D=6, R=3, E=5, A=6, Di=5 = 5.0 (Medium)
Current Mitigations:

BetterStack access controls and authentication
Encrypted data transmission to BetterStack
Network isolation for observability traffic
Limited telemetry data retention policies

Recommended Mitigations:

Enhanced BetterStack access controls with multi-factor authentication
Telemetry data encryption at rest and in transit
Data masking and sanitization for sensitive metrics
Regular security assessments of observability infrastructure
Separate observability networks with restricted access

Component: Security Monitoring & Incident Detection Systems
Threat: Attackers exploit monitoring blind spots or disable monitoring systems during security incidents to avoid detection
Impact: Undetected security breaches, delayed incident response, compromised forensic evidence, extended attack dwell time
DREAD Score: D=8, R=6, E=6, A=7, Di=7 = 6.8 (Medium)
Current Mitigations:

Multi-layered monitoring with BetterStack and application logs
Health checks and monitoring system validation
Distributed logging across multiple services
Basic alerting for system anomalies

Recommended Mitigations:

Redundant monitoring systems with independent data paths
Monitoring system integrity checks and tamper detection
Out-of-band monitoring and alerting mechanisms
Real-time monitoring coverage validation and gap analysis
Automated incident response triggers for monitoring failures

5. Denial of Service Threats

5.1 Resource Exhaustion

Component: PDF Processing Pipeline
Threat: Attacker uploads large or complex PDFs to exhaust system resources
Impact: Service unavailability, performance degradation
DREAD Score: D=7, R=8, E=6, A=7, Di=8 = 7.2 (High)
Current Mitigations:

File size limits
Celery worker resource limits
Redis queue management
Container resource constraints

Recommended Mitigations:

Rate limiting on uploads
PDF complexity analysis
Auto-scaling infrastructure
Circuit breaker patterns

5.2 Database Connection Exhaustion

Component: PostgreSQL Connection Pool
Threat: Excessive database connections causing service unavailability
Impact: Application downtime, data access failures
DREAD Score: D=8, R=6, E=5, A=8, Di=6 = 6.6 (Medium)
Current Mitigations:

Connection pooling with limits
Connection timeout settings
Health checks and monitoring

Recommended Mitigations:

Connection pool monitoring
Automatic connection cleanup
Database query optimization
Load balancing across read replicas

5.3 Third-Party Service Dependencies

Component: External API Integrations
Threat: Third-party service outages affecting system availability
Impact: Service degradation, business process interruption
DREAD Score: D=6, R=5, E=2, A=7, Di=3 = 4.6 (Low)
Current Mitigations:

Timeout configurations
Error handling and retries
Service health monitoring

Recommended Mitigations:

Circuit breaker implementation
Graceful degradation modes
Alternative service providers
Offline processing capabilities

5.4 Distributed Rate Limiting Bypass

Component: Rate Limiting Infrastructure & Cloudflare Protection
Threat: Attackers use distributed botnets across multiple IP ranges to bypass rate limiting controls
Impact: Service unavailability, resource exhaustion, infrastructure costs
DREAD Score: D=8, R=7, E=6, A=8, Di=7 = 7.2 (High)
Current Mitigations:

Cloudflare DDoS protection
Basic rate limiting rules (as planned in rate limiting document)
IP-based blocking mechanisms
Container resource constraints

Recommended Mitigations:

Advanced behavioral analysis beyond IP-based limiting
Geolocation-based traffic filtering
Machine learning-based attack pattern detection
Adaptive rate limiting based on traffic patterns
Multi-layer defense with edge and application-level protection

5.5 Application-Layer Resource Exhaustion

Component: PDF Processing Pipeline & ERP Sync Operations
Threat: Targeted attacks on expensive operations like PDF processing and ERP synchronization to exhaust system resources
Impact: Service degradation, processing delays, increased infrastructure costs
DREAD Score: D=7, R=7, E=5, A=7, Di=6 = 6.4 (Medium)
Current Mitigations:

File size limits for PDF uploads
Celery worker resource constraints
ERP sync job throttling via Trigger.dev
Container memory and CPU limits

Recommended Mitigations:

Operation-specific rate limiting (PDF processing, ERP sync)
Resource usage monitoring and alerting
Priority queuing for critical operations
Auto-scaling based on resource utilization
Circuit breakers for expensive operations

5.6 Rate Limiting Evasion Techniques

Component: HTTP Request Processing & Header Validation
Threat: Attackers evade rate limiting through header manipulation, proxy chains, or user agent rotation
Impact: Bypassed security controls, continued service disruption
DREAD Score: D=6, R=6, E=5, A=6, Di=7 = 6.0 (Medium)
Current Mitigations:

Basic IP-based rate limiting
User agent validation (as planned in rate limiting document)
Request pattern analysis
Cloudflare bot detection

Recommended Mitigations:

Multi-factor rate limiting (IP, user agent, request patterns)
Header fingerprinting and validation
Proxy detection and blocking
Advanced bot detection algorithms
Request signature validation

6. Elevation of Privilege Threats

6.1 Role-Based Access Control Bypass

Component: Admin Panel & User Management
Threat: Users escalate privileges to access admin functions
Impact: Unauthorized system administration, data manipulation
DREAD Score: D=8, R=4, E=5, A=6, Di=6 = 5.8 (Medium)
Current Mitigations:

Clerk role-based authentication
Admin-only endpoint protection
Role validation in middleware

Recommended Mitigations:

Regular access reviews
Principle of least privilege enforcement
Multi-factor authentication for admin accounts
Privilege escalation monitoring

6.2 Container Escape

Component: Docker Containerized Services
Threat: Attacker escapes container to access host system
Impact: Full system compromise, lateral movement
DREAD Score: D=9, R=2, E=7, A=6, Di=3 = 5.4 (Medium)
Current Mitigations:

Non-root container execution
Resource limits and constraints
Container image security scanning

Recommended Mitigations:

Container runtime security
Host-level monitoring
Network micro-segmentation
Regular container updates

6.3 ERP System Privilege Escalation

Component: Customer’s ERP System Integration
Threat: Exploitation of ERP system vulnerabilities for privilege escalation
Impact: ERP system compromise, business data manipulation
DREAD Score: D=9, R=2, E=6, A=7, Di=3 = 5.4 (Medium)
Current Mitigations:

Limited ERP API permissions
Dedicated service accounts
API endpoint restrictions

Recommended Mitigations:

ERP system security hardening
Regular security assessments
API permission auditing
Network access controls

6.4 ERP Sync Job Privilege Escalation

Component: Trigger.dev ERP Sync Jobs
Threat: ERP sync jobs escalate privileges beyond intended scope
Impact: Unauthorized access to sensitive ERP data, system compromise
DREAD Score: D=8, R=4, E=5, A=6, Di=5 = 5.6 (Medium)
Current Mitigations:

Job-specific permissions in Trigger.dev
ERP connection access controls
Limited batch processing scope

Recommended Mitigations:

Principle of least privilege for sync jobs
Job permission auditing and monitoring
Separate credentials for different sync operations
Regular review of job permissions and access patterns

Security Controls Matrix

Component	Authentication	Authorization	Encryption	Monitoring	Backup/Recovery	Supply Chain	DDoS Protection	Data Residency
webapp	Clerk JWT	Role-based	HTTPS/TLS	BetterStack + Anomaly Detection	Git versioning	Dependency scanning	Rate limiting + Cloudflare	Regional deployment
pdf-api	Service Token → mTLS	Endpoint-based	HTTPS/TLS + mTLS	BetterStack + Network monitoring	Container restart + Backup validation	Container signing	Circuit breakers	Data localization
pdf-worker	Shared Redis + ACLs	Queue-based + Task validation	HTTPS/TLS	BetterStack + Queue monitoring	Task retry + Recovery validation	Image attestation	Resource limits	Processing controls
PostgreSQL	Connection auth	User-based + RBAC	TLS + Field encryption	Query logs + Integrity checks	Neon backups + Immutable storage	N/A	Connection pooling	Regional storage
Cloudflare R2	API keys + Rotation	Bucket policies + IAM	Server-side + Client encryption	Access logs + Anomaly detection	Versioning + Immutable backups	N/A	DDoS protection	Geographic controls
Redis/Upstash	Password auth + ACLs	Queue-based + Validation	TLS + Task signing	Basic + Queue monitoring	Persistence + Integrity checks	N/A	Rate limiting	Regional deployment
Customer’s ERP	Bearer token + Rotation	API-based + Least privilege	HTTPS + Certificate pinning	Request logs + Anomaly detection	ERP native + Sync validation	N/A	Circuit breakers	Cross-border controls
Resend Email	API keys + Rotation	Domain-based + Validation	HTTPS + Content encryption	Delivery logs + PII detection	Retry queue + Audit trails	N/A	Rate limiting	Data masking
GitHub API	Personal token + MFA	Repository-based + Enhanced	HTTPS + Data encryption	Issue logs + PII scanning	Issue history + Retention policies	Secrets scanning	Rate limiting	Data sanitization
Trigger.dev Jobs	API keys + Enhanced auth	Job-based + Least privilege	HTTPS + Data encryption	Execution logs + Enhanced monitoring	Job retry + Validation	Job attestation	Resource controls	Data access restrictions
GitHub Actions	OIDC tokens + Enhanced	Workflow-based + Approval	HTTPS + Artifact signing	Action logs + Build monitoring	Git history + Artifact backup	Supply chain security	Build isolation	Secure environments
AI Tools	GitHub OAuth + Restrictions	Repository-based + Limited	HTTPS + Data classification	Access logs + Activity monitoring	Git history + Access audits	Code analysis restrictions	Access rate limiting	Data exposure controls
GHCR (Container Registry)	OIDC tokens + Image signing	Registry-based + Provenance	HTTPS + Image encryption	Registry logs + Vulnerability scanning	Image versioning + Immutable storage	Image attestation + Scanning	Access controls	Regional storage
BetterStack Platform	Enhanced MFA + Access controls	Role-based + Data masking	HTTPS + Telemetry encryption	Self-monitoring + Integrity checks	Backup + Retention policies	Platform security	Monitoring isolation	Data residency controls
Docker Network	Container auth + mTLS	Network policies + Segmentation	TLS + Traffic encryption	Network monitoring + Anomaly detection	Configuration backup + Recovery	Image security + Scanning	Network isolation	Regional deployment

Incident Response Plan

Detection

Automated Monitoring: BetterStack alerts for anomalous behavior with SIEM correlation rules
Log Analysis: Centralized logging with machine learning-based anomaly detection
Performance Monitoring: Resource usage and response time alerts with baseline deviation detection
Security Scanning: Continuous vulnerability assessments and penetration testing
AI Tool Monitoring: Repository access and PR creation monitoring with behavior analysis
Threat Intelligence: Integration with external threat feeds and indicators of compromise (IOCs)

Response Procedures

1. Immediate Response (0-30 minutes)

Alert Triage: Automated severity classification and initial containment triggers
Evidence Preservation: Automated snapshot creation of affected systems and logs
Initial Containment: Isolate affected components using predefined automation scripts
Notification: Alert incident response team and stakeholders via automated channels

2. Assessment Phase (30 minutes - 2 hours)

Scope Determination: Map affected systems, data, and users using network topology analysis
Impact Analysis: Assess business impact using predefined impact matrices
Root Cause Analysis: Initial forensic examination and attack vector identification
Risk Assessment: Evaluate potential for lateral movement and data exfiltration

3. Containment Phase (2-6 hours)

Network Isolation: Segment affected network components and disable compromised accounts
Service Degradation: Implement graceful service degradation to maintain critical functions
Access Revocation: Temporary suspension of potentially compromised credentials
Evidence Collection: Comprehensive forensic data collection and chain of custody procedures

4. Eradication Phase (6-24 hours)

Threat Removal: Eliminate malware, close attack vectors, and patch vulnerabilities
System Hardening: Implement additional security controls and configuration changes
Credential Rotation: Force rotation of all potentially compromised secrets and tokens
Validation: Verify complete threat removal using multiple detection methods

5. Recovery Phase (24-72 hours)

Service Restoration: Gradual restoration of services with enhanced monitoring
Data Validation: Integrity checks and restoration from clean backups if necessary
Performance Monitoring: Continuous monitoring for performance degradation or anomalies
User Communication: Coordinated communication to affected users and stakeholders

6. Post-Incident Activities (1-2 weeks)

Lessons Learned: Comprehensive incident review and documentation
Process Improvement: Updates to incident response procedures and security controls
Training Updates: Enhanced security awareness training based on incident findings
Regulatory Reporting: Compliance reporting requirements and customer notifications

Threat-Specific Response Playbooks

Critical Data Breach (DREAD Score ≥ 8.5)

Immediate Actions: Complete service isolation, legal team notification, regulatory prep
Timeline: 72-hour breach notification requirements
Communication: Coordinated customer and regulatory communication plan
Recovery: Enhanced validation and security controls before restoration

AI Tool Compromise

Immediate Actions: Revoke AI tool access, review recent code changes, scan for malicious code
Investigation: Analysis of AI-generated commits and pull requests
Validation: Human review of all AI-suggested changes in the past 30 days
Prevention: Enhanced AI tool monitoring and access controls

ERP System Compromise

Immediate Actions: Isolate ERP connections, suspend sync operations, notify customer
Assessment: Validate data integrity across all synchronized entities
Recovery: Coordinated recovery with customer’s IT team and ERP vendor
Validation: Comprehensive data validation and sync verification

Supply Chain Attack

Immediate Actions: Halt CI/CD pipeline, quarantine builds, scan all dependencies
Investigation: Dependency analysis and compromise timeline establishment
Recovery: Clean environment rebuild and dependency validation
Prevention: Enhanced supply chain security controls and monitoring

Communication Plan

Internal Communication

Development Team: Technical incident details, remediation steps, code review requirements
System Administrators: Infrastructure changes, monitoring adjustments, access control updates
Management: Business impact, customer communication, regulatory implications, resource needs
Legal/Compliance: Regulatory requirements, disclosure obligations, customer contract implications

External Communication

Customers: Service impact, data exposure assessment, protective measures, timeline for resolution
Regulatory Bodies: Mandatory breach notifications, compliance impact, remediation plans
Partners/Vendors: Third-party service impact, coordinated response, security control validation
Public/Media: Coordinated public statement (if required), transparency commitment, security improvements

Documentation Requirements

Incident Timeline: Chronological sequence of events, actions taken, decisions made
Technical Analysis: Root cause analysis, attack vectors, system impact assessment
Response Effectiveness: Review of response procedures, communication effectiveness, lessons learned
Preventive Measures: New security controls, process improvements, training requirements
Regulatory Compliance: Documentation for regulatory reporting and audit requirements

Recovery Validation Procedures

System Integrity Validation

Configuration Verification: Automated comparison against known-good baselines
Data Integrity Checks: Cryptographic validation of critical data and backups
Network Security Validation: Port scans, configuration audits, access control verification
Application Security Testing: Automated security scanning and manual penetration testing

Business Process Validation

Order Processing: End-to-end testing of PDF upload, processing, and ERP integration
User Authentication: Multi-factor authentication testing and access control validation
ERP Synchronization: Complete sync cycle testing with data integrity verification
Monitoring Systems: Validation of all monitoring, alerting, and logging systems

Continuous Improvement

Regular Updates (Monthly)

Threat Intelligence: Update IOCs, attack patterns, and detection rules
Procedure Reviews: Review and update incident response procedures
Training Sessions: Regular tabletop exercises and scenario-based training
Tool Validation: Test incident response tools and automation scripts

Annual Reviews

Comprehensive Assessment: Full incident response capability assessment
Industry Benchmarking: Comparison with industry best practices and standards
Regulatory Alignment: Ensure procedures meet current regulatory requirements
Technology Updates: Evaluate new incident response technologies and tools

Conclusion

The ERP-Unlocked system demonstrates a comprehensive security architecture with multiple layers of protection. The primary risks are concentrated around:

Direct client-to-R2 uploads requiring robust validation and monitoring (DREAD Score: 5.8)
Service-to-service authentication using shared tokens that should be replaced with Clerk-based auth (DREAD Score: 5.8)
Network isolation of internal services (pdf-api) from external access (DREAD Score: 5.0)
Trigger.dev job permissions with broad access to sensitive data and services (DREAD Score: 5.6)
AI development tool access with full repository visibility (DREAD Score: 6.4)
Third-party service dependencies and the complexity of the AI-powered processing pipeline (DREAD Score: 4.6)

The threat model identifies 31 specific threats across the STRIDE categories, with DREAD risk scores ranging from 4.6 to 7.2, indicating a well-managed risk profile with no critical unmitigated threats. The highest-risk threats are primarily in the Denial of Service category, specifically around Resource Exhaustion (7.2) and Distributed Rate Limiting Bypass (7.2).

Key architectural security features include:

Network Isolation: pdf-api is not exposed to the internet, only accessible within the Docker network
Direct R2 Access: webapp and Trigger.dev jobs interact directly with R2 storage using signed URLs
Service Authentication: X-Service-Token authentication between webapp and pdf-api (should be upgraded to Clerk)
Data Flow Separation: Clear separation between public (webapp) and private (pdf-api, pdf-worker) services
ERP Abstraction: Flexible ERP integration through factory pattern supporting multiple ERP systems
Orchestrated Data Sync: Trigger.dev jobs handle critical ERP data synchronization with validation and health checks
Support Ticket System: GitHub API integration for customer support with data sanitization (medium priority for review)

The recommended enhancements focus on:

HIGH PRIORITY: Resource Exhaustion Prevention - Implement comprehensive rate limiting and auto-scaling (DREAD Score: 7.2)
HIGH PRIORITY: DDoS Protection Enhancement - Advanced behavioral analysis and multi-layer defense (DREAD Score: 7.2)
Replacing service tokens with Clerk-based authentication for consistency (DREAD Score: 5.8)
Implementing server-side validation for direct R2 uploads (DREAD Score: 5.8)
Enhancing monitoring and privilege controls for Trigger.dev ERP sync jobs (DREAD Score: 5.6)
Strengthening AI tool access controls and monitoring (DREAD Score: 6.4)
Implementing comprehensive audit logging with non-repudiation capabilities across all services
Developing detailed incident response playbooks for threat-specific scenarios

Regular reviews and updates of this threat model are recommended as the system evolves and new threats emerge. The security posture should be continuously monitored and improved based on threat intelligence and incident response learnings. The formalized DREAD scoring system provides a standardized framework for prioritizing security investments and tracking risk reduction over time.

Document Control:

Author: Devin (Original), Updated by Assistant
Reviewer: [To be assigned]
Next Review Date: [6 months from creation]
Classification: Internal Use Only

ERP-Unlocked Threat Model

Executive Summary

System Overview

Key Components

Risk Assessment Methodology

DREAD Risk Scoring Framework

Risk Levels

Trust Boundaries

Service-Specific Architecture Diagrams

Webapp Service Architecture

PDF API Service Architecture

PDF Worker Service Architecture

ERP Sync Service Architecture (Trigger.dev Jobs)

System Architecture & Data Flow

Primary Data Flows

Service Authentication Patterns

AI Development Tools Access

Repository Access and Capabilities

Security Implications

STRIDE Threat Analysis

1. Spoofing Threats

1.1 Authentication Bypass

1.2 Service Token Spoofing

1.3 ERP System Impersonation

1.4 ERP Sync Job Impersonation

1.5 Internal Network Lateral Movement

2. Tampering Threats

2.1 PDF Content Manipulation

2.2 Database Injection

2.3 CI/CD Pipeline Tampering

2.4 Service Token Tampering

2.5 Direct R2 Upload Tampering

2.6 ERP Sync Data Tampering

2.7 Support Ticket Data Tampering

2.8 AI Tool Generated Malicious Code

2.9 Compromised Package Dependencies

2.10 Malicious Package Installation

2.11 Service Mesh Vulnerabilities

2.12 Redis Queue Poisoning

2.13 Backup Data Tampering

2.14 Log Injection and Audit Trail Manipulation

2.15 Malicious Container Images in GHCR

2.16 Container Image Tampering During CI/CD Pipeline

3. Repudiation Threats

3.1 Order Processing Audit Trail

3.2 ERP Integration Logging

3.3 Administrative Action Accountability

3.4 AI Development Tool Actions

4. Information Disclosure Threats

4.1 Sensitive Data Exposure

4.2 Customer Data Leakage

4.3 ERP System Data Exposure

4.4 Trigger.dev Data Access

4.5 Network Boundary Bypass

4.6 Email Service Data Exposure

4.7 GitHub API Data Exposure

4.8 AI Tool Data Exposure

4.9 Data Residency Compliance Violations

4.10 Cross-Border ERP Data Transfer Violations

4.11 Audit Trail Compliance Gaps

4.12 Backup Data Exposure During Recovery

4.13 Incomplete Recovery Data Integrity Issues

4.14 BetterStack Observability Platform Compromise

4.15 Monitoring Blind Spots During Security Incidents

5. Denial of Service Threats

5.1 Resource Exhaustion

5.2 Database Connection Exhaustion

5.3 Third-Party Service Dependencies

5.4 Distributed Rate Limiting Bypass

5.5 Application-Layer Resource Exhaustion

5.6 Rate Limiting Evasion Techniques

6. Elevation of Privilege Threats

6.1 Role-Based Access Control Bypass

6.2 Container Escape

6.3 ERP System Privilege Escalation

6.4 ERP Sync Job Privilege Escalation

Security Controls Matrix

Incident Response Plan

Detection

Response Procedures