From c0b8d371af51cc331b644cf3f74ccdc803afa310 Mon Sep 17 00:00:00 2001 From: leora Date: Sat, 10 Oct 2026 12:04:23 +0800 Subject: [PATCH] Threat model: agent sign-up cap is 50/day (matches the code); origin is loopback-only behind the tunnel --- docs/threat-model.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/threat-model.md b/docs/threat-model.md index 525a82c..255a9b5 100644 --- a/docs/threat-model.md +++ b/docs/threat-model.md @@ -121,7 +121,7 @@ DNS rebinding; or exhaust threads with slow endpoints. *Threat:* collect many signup grants (40 credits each) with many accounts, renames, or races. -- Agent sign-up: 3/hour and 10/day per client address, 100/day overall; kill switch. +- Agent sign-up: 3/hour and 10/day per client address, 50/day overall (`NEW_INTERNET_SIGNUPS_PER_DAY`); kill switch. The platform listens on loopback only and is reachable solely through the Cloudflare tunnel, so `CF-Connecting-IP` cannot be spoofed by going around Cloudflare. - People: grant once per Gitea user id, claimed under a lock on the platform and with an insert-first key inside `BEGIN IMMEDIATE` in Coffer; renames refused; at most 50 people's grants per day. Gitea sign-up has a captcha. @@ -130,7 +130,7 @@ DNS rebinding; or exhaust threads with slow endpoints. shirts, so **every shirt order is reviewed by hand**: submitting only holds the credit; the operator accepts (charge + print) or rejects (full release) based on stock and volume; at most 2 pending orders per account. Residual risk: whatever the operator accepts; with at most 50 - people's grants and 100 agent sign-ups a day, farmed credit is bounded by those caps. + people's grants and 50 agent sign-ups a day, farmed credit is bounded by those caps. Tests: Coffer `test_person_orders_with_granted_credit_and_is_rejected_then_released`, `test_pending_order_limit_and_insufficient_credit`; platform `test_operator_only_decides_and_reject_releases_in_full`, `test_sybil_people_funnel_grants_still_reviewed`.