Backend API (Spring Boot 3.3.5, Java 17), PostgreSQL database, MinIO object storage, Flutter mobile app. Deployed on k3s (TransIP VPS 136.144.174.219). Photo integrity verification via HMAC-SHA256 signatures with versioned key rotation. JWT authentication (self-issued). AI-based photo authenticity detection (optional, Hive provider).

2. Risk Register

| ID | Risk | Category | Likelihood (1-5) | Impact (1-5) | Score | Owner | Status | |----|------|----------|-----------------|--------------|-------|-------|--------| | R01 | HMAC secret compromise allows forged photo signatures | Security | 2 | 5 | 10 | GloryLabs | Open | | R02 | Ransomware encrypts PostgreSQL + MinIO data | Security | 2 | 5 | 10 | GloryLabs | Open | | R03 | GDPR breach — photo PII stored unencrypted at field level | Compliance | 3 | 4 | 12 | GloryLabs | Open | | R04 | JWT secret compromise allows unauthorised API access | Security | 2 | 4 | 8 | GloryLabs | Open | | R05 | DB superuser credentials used by app — full DB access if breached | Security | 3 | 4 | 12 | GloryLabs | Open | | R06 | MinIO data loss (single node, no replication) | Technical | 2 | 4 | 8 | GloryLabs | Open | | R07 | Key person dependency — single developer | Operational | 3 | 3 | 9 | GloryLabs | Open | | R08 | AI detection false positives harm legitimate users | Business | 3 | 3 | 9 | GloryLabs | Open |

Score = Likelihood × Impact

1–4: Low
5–9: Medium
10–16: High
17–25: Critical

3. Risk Detail

R01 — HMAC secret compromise allows forged photo signatures

Category: Security Description: If the HMAC secret leaks, an attacker can generate valid signatures for fabricated photos, undermining the entire integrity verification model. Likelihood: 2 (unlikely — secrets in Sealed Secrets + 1Password) Impact: 5 (catastrophic — product's core value proposition destroyed) Score: 10 — High Current controls:

HMAC secrets stored in 1Password, deployed via Bitnami Sealed Secrets
Secrets never in code or logs
Versioned key architecture (HmacKeyRegistry) enables zero-downtime rotation Residual risk: Medium (after rotation automation deployed) Treatment: Mitigate Mitigation actions:
[x] Implement versioned HMAC key rotation architecture (PR merged 2026-03-28)
[x] Create quarterly rotation workflow .github/workflows/rotate-hmac.yml
[ ] Complete first production key rotation (#30)
[ ] Add alerting if re-signing job stalls Owner: GloryLabs Target date: 2026-04-30

R02 — Ransomware encrypts PostgreSQL + MinIO data

Category: Security Description: A ransomware attack on the VPS could encrypt all photo hashes, signatures, and stored images — destroying the audit trail permanently. Likelihood: 2 (VPS is internet-facing) Impact: 5 (catastrophic — all audit evidence lost) Score: 10 — High Current controls:

k3s runs as non-root
No direct DB port exposed externally Residual risk: High (no immutable backups yet) Treatment: Mitigate Mitigation actions:
[ ] Implement immutable WORM off-site backups (#27)
[ ] Enable etcd encryption at rest on k3s (#142)
[ ] Test restore procedure quarterly Owner: GloryLabs Target date: 2026-06-01

R03 — GDPR — photo metadata stored without field-level encryption

Category: Compliance Description: userId, sha256, capturedAt are stored in plaintext. A DB breach exposes linkable personal data. Art. 32 GDPR requires appropriate technical measures. Likelihood: 3 Impact: 4 (significant GDPR fine + reputational damage) Score: 12 — High Current controls:

DB credentials via Sealed Secrets
TLS on API ingress
Non-root DB user (partially — issue #28 open) Residual risk: High (no field-level encryption) Treatment: Mitigate Mitigation actions:
[ ] Implement AES-256 field-level encryption for userId, sha256 (#29)
[ ] Remove DB superuser from app config (#28)
[ ] Enable etcd encryption at rest (#142) Owner: GloryLabs Target date: 2026-06-01

R04 — JWT secret compromise

Category: Security Description: If the JWT signing secret leaks, an attacker can mint valid tokens for any user. Likelihood: 2 Impact: 4 Score: 8 — Medium Current controls:

JWT secret in 1Password / Sealed Secrets
Refresh token rotation implemented
Short access token TTL (24h) Residual risk: Medium Treatment: Mitigate Mitigation actions:
[ ] Automated JWT secret rotation workflow (#31) Owner: GloryLabs Target date: 2026-06-01

R05 — DB superuser credentials used by application

Category: Security Description: If the application connects to PostgreSQL with superuser privileges, a SQL injection or app-level breach gives full database access. Likelihood: 3 (current config may use default superuser) Impact: 4 Score: 12 — High Current controls: None confirmed Residual risk: High Treatment: Mitigate Mitigation actions:

[ ] Create least-privilege DB role (SELECT, INSERT, UPDATE, DELETE only on app tables) (#28)
[ ] Rotate credentials after privilege reduction Owner: GloryLabs Target date: 2026-05-01

R06 — MinIO data loss (single node)

Category: Technical Description: MinIO runs as a single node on the VPS. Disk failure or accidental deletion permanently loses all stored photos. Likelihood: 2 Impact: 4 Score: 8 — Medium Current controls: None Residual risk: High Treatment: Mitigate Mitigation actions:

[ ] Replicate MinIO to off-site S3-compatible storage (#27)
[ ] Automate daily snapshot Owner: GloryLabs Target date: 2026-06-01

R07 — Key person dependency

Category: Operational Description: Single developer knows the full system. Illness or departure creates operational risk. Likelihood: 3 Impact: 3 Score: 9 — Medium Current controls:

CLAUDE.md documents architecture
OCS compliance docs maintained
GitHub Issues track all open work Residual risk: Medium Treatment: Accept (early stage) Mitigation actions:
[ ] Ensure runbooks cover all production operations Owner: GloryLabs Target date: 2026-12-01

R08 — AI detection false positives

Category: Business Description: Hive AI detection incorrectly flags genuine photos as AI-generated, undermining user trust. Likelihood: 3 Impact: 3 Score: 9 — Medium Current controls:

AI detection disabled by default (AI_DETECTION_ENABLED=false)
aiDetectionStatus field tracks PENDING/SUCCESS/FAILED
Confidence score stored for manual review Residual risk: Medium Treatment: Mitigate Mitigation actions:
[ ] Define confidence threshold and manual review flow before enabling in production
[ ] Add appeals process for false positives Owner: GloryLabs Target date: 2026-09-01

4. Risk Categories

| Category | Definition | |----------|-----------| | Technical | Infrastructure failures, bugs, dependencies, scalability | | Security | Data breaches, ransomware, unauthorised access, vulnerabilities | | Compliance | GDPR violations, NIS2, BIO, regulatory fines | | Operational | Key person dependency, process failures, vendor lock-in | | Business | Client loss, revenue impact, reputational damage |

5. Risk Heat Map

Impact
  5 | R01| R02|    |    |    |
  4 | R04|    | R03| R05|    |
  3 |    |    | R06|    |    |
  3 |    |    | R07| R08|    |
  2 |    |    |    |    |    |
  1 |    |    |    |    |    |
    +----+----+----+----+----+
       1    2    3    4    5   Likelihood

Highest priority: R03 (GDPR field encryption), R05 (DB superuser), R01 (HMAC — partially mitigated).

6. Review History

| Version | Date | Author | Changes | |---------|------|--------|---------| | 1.0 | 2026-03-27 | GloryLabs | Initial version | | 1.1 | 2026-03-28 | GloryLabs | Added R01–R08 with full detail; updated HMAC rotation status to partially mitigated |

Reacties

Nog geen reacties

Athena — auditPic/compliance/risk-assessment.md

Risk Assessment — auditPic

1. Scope