Project-Kiln/docs/phase-0/threat-model.md

Initial threat model

Assets and boundaries

• Provider manifests, custom launch definitions, artwork, and frontend descriptors are untrusted.
• Discovery and launch parsing run as the gaming user, never root.
• Provider credentials remain owned by their provider/configuration owner.
• Project state is per-user under XDG paths and must use atomic replacement.
• Future IPC is local, owner-only, size-limited, authenticated by OS credentials, and optional.

Mandatory controls before provider work

Use argument arrays rather than interpolated shells; reject traversal, control characters, oversized inputs, unsafe symlinks, and unexpected encodings; redact tokens and personal paths from evidence; constrain reads to documented roots; and keep fixtures free of proprietary library dumps and live credentials.