# Threat Model -- LLMHosts.com

## META
- created: 2026-02-14
- framework: STRIDE per-component
- purpose: Concrete attack vectors for Get-er-DONE L7/L7.5 security testing
- references: system-architecture.md (Section 7), openapi.yaml

---

## THREAT REGISTRY

### API Proxy (LiteLLM)

| ID | STRIDE | Attack Vector | Impact | Likelihood | Mitigation | Test Case |
|----|--------|--------------|--------|------------|------------|-----------|
| T-01 | Tampering | Prompt injection via chat completion request body | Unauthorized model behavior, data exfiltration | High | Input sanitization, request size limits, content filtering | Send crafted prompt with system override instructions; verify proxy rejects or sanitizes |
| T-02 | Spoofing | Forged API key in Authorization header | Unauthorized access to inference | High | API key validation, rate limiting per key, key rotation | Send requests with invalid/expired/revoked keys; verify 401 response |
| T-03 | Spoofing | Replay attack: captured valid request replayed | Duplicate inference charges, stale responses | Medium | Request nonce/timestamp validation, idempotency keys | Replay a valid request after 60s; verify rejection or deduplication |
| T-04 | Info Disclosure | Error messages leak internal model names or paths | Architecture exposure | Medium | Generic error responses, no stack traces in production | Trigger 500 errors; verify response contains no internal paths or model details |
| T-05 | DoS | Token exhaustion: send max_tokens=infinity requests | GPU resource starvation | High | Enforce max_tokens ceiling per tier, request queue with timeout | Send request with max_tokens=1000000; verify proxy caps to configured limit |

### Cache (vCache)

| ID | STRIDE | Attack Vector | Impact | Likelihood | Mitigation | Test Case |
|----|--------|--------------|--------|------------|------------|-----------|
| T-06 | Tampering | Cache poisoning: craft request that stores malicious response | Subsequent users get poisoned response | High | Cache key includes full request hash, TTL expiry, cache clear endpoint | Insert known response via direct request; send semantically similar query; verify response is NOT the poisoned one unless exact match |
| T-07 | Tampering | Semantic similarity oracle: probe cache with varied inputs to extract cached responses | Data exfiltration via cache side-channel | Medium | Per-user cache namespaces, similarity threshold enforcement | Send progressively similar queries; verify cache only returns hits above configured threshold |
| T-08 | Info Disclosure | Cache entries contain PII from previous requests | Privacy violation (GDPR) | High | PII detection before caching, namespace isolation, cache TTL | Send request containing PII (email, name); verify cache entry is either not stored or redacted |
| T-09 | DoS | Cache flooding: send unique requests to exhaust cache storage | Memory/disk exhaustion | Medium | Cache size limits, LRU eviction, rate limiting | Send 10K unique requests; verify cache evicts old entries and stays within size limit |
| T-10 | Repudiation | No audit trail for cache hits vs misses | Cannot verify cache behavior claims | Low | Log cache decisions with request ID | Verify every request has cache_hit/cache_miss logged with correlation ID |

### Router (Conductor)

| ID | STRIDE | Attack Vector | Impact | Likelihood | Mitigation | Test Case |
|----|--------|--------------|--------|------------|------------|-----------|
| T-11 | Tampering | Routing manipulation: craft request metadata to force specific tier | Bypass cost optimization, force expensive model | Medium | Router uses content analysis not metadata, tier selection is server-side | Send request with spoofed routing hints; verify router ignores them |
| T-12 | Info Disclosure | Routing decision headers expose model selection logic | Competitive intelligence leak | Low | Routing details in internal metrics only, not response headers | Inspect all response headers; verify no routing tier or model name is exposed |
| T-13 | Tampering | Model confusion: trick router into sending request to wrong backend | Wrong model serves request, quality degradation | Medium | Router validates backend health before routing, fallback chain | Kill a backend; verify router falls back correctly without serving errors |

### Tunnel (Tailscale/Cloudflare)

| ID | STRIDE | Attack Vector | Impact | Likelihood | Mitigation | Test Case |
|----|--------|--------------|--------|------------|------------|-----------|
| T-14 | Spoofing | Unauthorized device connects via tunnel | Unauthorized inference access from unknown device | High | Device authentication, device allowlist, tunnel requires Pro tier | Attempt tunnel connection from unregistered device; verify rejection |
| T-15 | Tampering | Man-in-the-middle on tunnel traffic | Request/response modification | Low | WireGuard encryption (Tailscale), TLS (Cloudflare) | Verify all tunnel traffic is encrypted; attempt MITM with proxy; verify failure |
| T-16 | Elevation | Tunnel escalation: gain access to host network beyond LLMHosts ports | Full host compromise | Medium | Tunnel binds to specific ports only, no shell access, sandboxed Docker | Attempt to access non-LLMHosts ports via tunnel; verify connection refused |

### Dashboard (Next.js)

| ID | STRIDE | Attack Vector | Impact | Likelihood | Mitigation | Test Case |
|----|--------|--------------|--------|------------|------------|-----------|
| T-17 | Tampering | XSS via model name or request content displayed in dashboard | Session hijacking, data theft | Medium | Content Security Policy, output encoding, React auto-escaping | Inject script tag in model name; verify it renders as text not executable |
| T-18 | Spoofing | CSRF on dashboard settings endpoints | Unauthorized config changes | Medium | CSRF tokens, SameSite cookies, origin validation | Send settings change from external origin; verify rejection |
| T-19 | Info Disclosure | Dashboard exposes API keys in browser | Key theft | High | Keys shown masked (last 4 chars only), never in DOM, server-side only | Inspect DOM and network requests; verify no full API key appears |

### BYOK (Bring Your Own Key)

| ID | STRIDE | Attack Vector | Impact | Likelihood | Mitigation | Test Case |
|----|--------|--------------|--------|------------|------------|-----------|
| T-20 | Info Disclosure | BYOK keys logged in request logs | Key exfiltration via logs | Critical | Strip Authorization header from all logs, key stored encrypted at rest | Search all log outputs for API key patterns; verify zero matches |
| T-21 | Info Disclosure | BYOK keys stored in plaintext in SQLite | Key theft via DB access | High | Encrypt keys at rest (Fernet/AES), key derivation from master password | Read SQLite directly; verify keys are encrypted blobs not plaintext |
| T-22 | Tampering | Key rotation failure: old keys still work after rotation | Revoked access persists | Medium | Key rotation invalidates old keys immediately, no grace period | Rotate a key; immediately use old key; verify 401 |

### Database (SQLite/PostgreSQL)

| ID | STRIDE | Attack Vector | Impact | Likelihood | Mitigation | Test Case |
|----|--------|--------------|--------|------------|------------|-----------|
| T-23 | Tampering | SQL injection via config or search inputs | Data corruption, exfiltration | Medium | Parameterized queries only (SQLAlchemy ORM), no raw SQL | Send SQL injection payloads in all input fields; verify no injection |
| T-24 | Info Disclosure | PII in request logs stored in database | GDPR violation | High | PII detection and redaction before storage, configurable log retention | Store requests containing PII; verify PII is redacted in stored logs |

### Hive Mode (Phase 3)

| ID | STRIDE | Attack Vector | Impact | Likelihood | Mitigation | Test Case |
|----|--------|--------------|--------|------------|------------|-----------|
| T-25 | Spoofing | Malicious node joins Hive with fake GPU specs | Free-loading, wrong routing decisions | Medium | GPU verification on join (benchmark test), reputation/karma system | Join Hive with spoofed GPU specs; verify detection and rejection |
| T-26 | Info Disclosure | Request content visible to Hive node operator | Privacy violation across users | High | Privacy-tiered routing (sensitive requests stay local), E2E encryption | Send PII-flagged request in Hive; verify it routes to local GPU only |

---

## PRIORITY MATRIX

| Priority | IDs | Count |
|----------|-----|-------|
| Critical | T-20 | 1 |
| High | T-01, T-02, T-05, T-06, T-08, T-14, T-19, T-21, T-24, T-26 | 10 |
| Medium | T-03, T-04, T-07, T-09, T-11, T-13, T-16, T-17, T-18, T-22, T-23, T-25 | 12 |
| Low | T-10, T-12, T-15 | 3 |

---

## TRACEABILITY

Each threat ID (T-01 through T-26) maps to a test case that Get-er-DONE L7.5 Security Attacker should implement. Test files: tests/security/test_threat_{id}.py (e.g., test_threat_t01.py).
