Complete the threat model and harden web, API, content, and export boundaries

[alexeygrigorev]

Parent epic: #8

Normative spec: 07 — Security

Scope

Create reviewed actor/data-flow/threat and authorization matrices; implement/test HTTPS/proxy/host/origin/cookie/CSRF/CORS/CSP/frame/MIME/referrer/permissions headers, safe errors, request/file/decompression/time limits, edge/app/business throttles, honeypot, content sanitization/traversal/symlink defense, SSRF-safe asynchronous URL checks, CSV formula defense, secret/token/PII redaction, dependency/container scans, and high-risk control hooks across public/learner/Studio/API/webhooks/jobs.

Non-goals

No inaccessible mandatory CAPTCHA by default, wildcard origins/permissions, synchronous arbitrary URL fetch, or security-through-hidden-object-error leakage.

Acceptance criteria

• Threat/authorization matrix names each actor, asset, boundary, attack, control, owner, and verification.
• Security headers/session/CSRF/CORS/request limits/errors are environment-correct and no-store on protected surfaces.
• XSS/unsafe URL/content, traversal/symlink, SSRF/private-network, CSV injection, webhook forgery/replay, mass assignment, and object/field authorization suites pass.
• Secrets/tokens/PII are absent from URL/log/metric/trace/audit/error/browser artifact scans.
• Dependency/container/security checks block release on defined severity policy.
• Critical findings have remediation owner; accepted risk requires explicit expiry/approval.

Test scenarios

1. Automated attack matrix for CSRF/CORS/CSP/XSS/SSRF/traversal/file bomb/body limits/rate limits/session/auth errors/API fields/export.
2. Malicious GitHub content, learner URL, CSV cell, webhook/provider payload, and encoded/Unicode bypass variants.
3. Fault/error/debug/settings misconfiguration and log/artifact secret scanner.

Playwright

Exercise public registration/login, learner, Studio/API-backed operations under CSRF/session/rate/error cases; verify security headers, safe user messages, keyboard-accessible honeypot/challenge behavior, and screenshots.

Dependencies

Depends on #1 and #31–#33; expands as each domain ships. Identity specifics depend on #20/#61.