security.md (1601B)
1 --- 2 label: Security & Threat Model 3 icon: shield 4 order: 570 5 --- 6 7 # Cryptography & Security Model 8 9 ## Zero-knowledge cloud password protection 10 11 When a user applies a password to a Cloud Share snippet, the plaintext password is **never** transmitted to Firebase. Veyrix uses the native Web Crypto API to generate a SHA-256 hash locally instead: 12 13 ```javascript 14 // Internal Utility Method 15 async function hashPassword(password) { 16 const msgBuffer = new TextEncoder().encode(password); 17 const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer); 18 const hashArray = Array.from(new Uint8Array(hashBuffer)); 19 return hashArray.map(b => b.toString(16).padStart(2, '0')).join(''); 20 } 21 ``` 22 23 ## Threat model assumptions 24 25 ### 1. Physical security 26 27 Veyrix relies completely on the local OS and browser profile. If an attacker gains physical, unlocked access to the device, or compromises the browser profile (e.g. via a malicious extension), the IndexedDB store is considered compromised. 28 29 ### 2. Cross-Site Scripting (XSS) 30 31 Veyrix is an editor, not an evaluator. The Ace Editor parses content into Abstract Syntax Trees (ASTs) for highlighting — it does not execute code within the DOM. DOM string interpolations are secured via native `textContent` mappings. 32 33 ### 3. Cloud anonymity 34 35 Firebase interactions use `signInAnonymously()`. Data is tied to a temporary, anonymous session UID. Firebase Security Rules are assumed to enforce read/write access correctly based on the snippet UID, but shared URLs are considered semi-public unless protected with the SHA-256 password hash described above.