Security Model

Security Model

Prohori is a defensive tool. It contains no exploit code, scanners or attack tooling, and its simulator writes log files only; it never sends network traffic.

Logs are untrusted input

Everything Prohori reads may have been written by an attacker. The design therefore requires:

• Bounded line and field sizes; control and ANSI characters stripped.
• Safe YAML loading only; no eval; no pickle on untrusted data.
• Escaped output in HTML and Markdown reports; CSV formula injection neutralised.
• Timeouts on all HTTP calls; no infinite retries.
• Usernames, user agents and paths treated as data, never as instructions, including by the optional LLM analyst.

Secrets

API keys come only from environment variables or a git-ignored .env file. Secrets are never written to logs, reports or caches. Secret scanning runs in pre-commit and CI (gitleaks), and GitHub push protection is enabled.

Privacy

• Sample data is synthetic and uses documentation IP ranges.
• Private, reserved and documentation IP ranges are never sent to external enrichment services.
• Reports support redaction of usernames, emails and IP addresses.
• The LLM analyst is opt-in, off by default, and redacts incidents before sending them.

Supply chain

CodeQL, OpenSSF Scorecard, Dependabot and a committed lock file.

Reporting a vulnerability

Use GitHub private vulnerability reporting. Details are in SECURITY.md. A full threat model will be published in docs/THREAT_MODEL.md.