Skip to content

Threat Model

This page provides a summary of the key threats considered in the extension's design. The full threat model, including attack surface analysis, protected assets, and considered adversaries, is shared under agreement with partner institutions — contact panaceia@saude.dev .

T1 — Compromised browser extension

An attacker publishes a malicious version of the extension or compromises the build process, injecting code that exfiltrates clinical data.

Mitigations:

  • Core under AGPL-3.0-or-later — auditable under agreement with partner institutions
  • Reproducible builds as a long-term goal
  • Release signatures via Sigstore/Cosign (planned for v1.0)
  • Manifest V3 prohibits remote code execution (eval, remote_code)
  • Strict CSP in the manifest

T2 — Stolen device or unauthorized physical access

An attacker with physical access to the device attempts to access clinical data stored locally in the browser's IndexedDB.

Mitigations:

  • All sensitive fields encrypted with AES-256-GCM
  • Master key derived via Argon2id — resistant to brute-force attacks
  • Auto-lock after 15 minutes of inactivity (configurable)
  • Master key never persists to disk — only in memory during the session
  • "Forget device" clears the key without destroying data (re-derivable with password)

T3 — Network interception during export

When a user exports a FHIR Bundle to an institutional server, a network adversary intercepts the transmission.

Mitigations:

  • All export transmissions use HTTPS (TLS 1.2+)
  • Destination server certificate validation
  • User confirms destination before any transmission
  • Local backup remains encrypted regardless of export

T4 — Malicious or compromised pack

A pack published in the feed contains malicious logic that alters the FHIR mapping in harmful ways or exfiltrates data via the DSL.

Mitigations:

  • Declarative DSL — no procedural code, no eval, no arbitrary functions
  • Pack DSL is verified by pack-validator before installation
  • Each pack's signature is verified against trust anchors
  • Core packs signed by the panaceia-core trust anchor
  • Pack updates require user approval by default (auto mode is opt-in)
  • Signed feed served over immutable HTTPS (Cloudflare Pages)

To request the full threat model as a partner institution, or to report vulnerabilities, contact security@panaceia.io .