# Security Review — 2026-07-19

Scope: Aeonora browser vault, `/api/vault`, sync authorization, cryptography, dependencies, deployment headers, CLI key handling, adapters, Solidity registry, repository history, and CI/infrastructure surface.

## Result

No critical, high, or medium findings survived active verification at the 8/10 confidence gate.

- tracked files and Git history: no credential patterns found;
- npm dependency audit: 0 known vulnerabilities;
- vault API: same-origin gate, required 256-bit bearer capability, opaque public ciphertext objects, strict method allowlist, 4 MiB body cap, generic server errors;
- browser: AES-256-GCM, 600,000-round PBKDF2-SHA-256 domain-separated keys, 256-bit BIP-39 mnemonic, WebAuthn user verification and PRF wrapping; production create/sync/passkey/disconnect/recover/delete passed with a virtual PRF authenticator;
- deployment: CSP, HSTS, frame denial, no-referrer, permissions policy, MIME sniffing disabled; Cloudflare proxy and Vercel origin are live;
- plaintext: browser encryption occurs before network upload; API payload validator accepts encrypted envelope only;
- adapters: symlinks skipped, fixed supported Markdown surfaces, bridge injection idempotent;
- contract: controller checks protect update, lifecycle, and receipt methods; duplicate receipts rejected.

## Threat model

| Component | Main threats | Current control |
|---|---|---|
| Browser vault | phrase theft, XSS, malicious extension | strict CSP, no third-party runtime scripts, phrase not persisted, optional passkey wrapping |
| Sync API | spoofing, overwrite, enumeration | token-derived 128-bit vault ID, 256-bit token, version/commitment checks, ETag compare-and-swap writes |
| Blob storage | disclosure, deletion, rollback | public ciphertext at unguessable paths, client encryption, commitment chain; availability remains provider-dependent |
| Runtime adapter | secret capture, prompt injection | Markdown-only allowlists; credentials and runtime databases excluded |
| Registry contract | unauthorized mutation, fake receipts | `msg.sender` controller checks, immutable event history, duplicate receipt guard |
| Browser wallet | malicious provider, wrong network, transaction substitution | fixed Base Sepolia chain ID, wallet confirmation, compiled local ABI/bytecode, receipt status and expected event checks |

## Residual risk

1. No independent professional penetration test or Solidity audit.
2. No public-testnet contract receipt yet; current receipt is disposable local EVM evidence.
3. Vercel and the deployment account can delete ciphertext. Users need independent encrypted backups.
4. WebAuthn PRF support varies. Recovery phrase remains canonical.
5. Agent Markdown is untrusted prompt content. Harnesses must keep tool authorization outside brain text.
6. Current encryption is not post-quantum. X25519 and AES-256-GCM claims remain classical.
7. Cloudflare custom write-rate limiting is not active because the connected API token lacks Rate Limits edit permission. The API caps individual requests, but automated storage-cost abuse remains an operational launch risk.
8. IPFS is public and retention is independent of access control. Only ciphertext may be pinned; deleting a hosted vault does not guarantee deletion of previously pinned encrypted snapshots.
9. The production pin service exposes only authenticated, size-limited multipart adds. Kubo RPC ports 5001 and 8080 remain loopback-bound; the read-only gateway is separately proxied. The current single node is an availability risk, not a confidentiality boundary.

This AI-assisted review is not a substitute for a qualified professional audit. Security-sensitive production use needs an independent penetration test and contract review.