# Security Model Specification — Threat Model and Analysis

> Formal threat model for the Runtime Environment Protocol. Seven threat analyses covering XSS, CDN compromise, session key theft, env var leaks, and more. Hardening recommendations.

Source: https://rep-protocol.dev/spec/security-model/

```
Document:  REP Security Model
Version:   0.1.0
Status:    Active
Authors:   Olamide Adebayo (Ruach Tech)
License:   CC BY 4.0
```

> **Note**
>
> For a practical guide to REP's security properties, see [Security Model (Concepts)](/concepts/security-model/). This page is the formal specification document.

- [Security Model (Concepts)](/concepts/security-model/) — Practical guide — threat analysis, hardening, monitoring recommendations

The concepts page contains the full content of this specification, reformatted for easier navigation. It covers:

- Fundamental axiom and trust boundaries
- All 7 threat analyses (T1-T7) with severity, mitigations, and residual risk
- Variable classification decision tree with common misclassifications
- Production hardening recommendations (gateway config, FROM scratch Dockerfile, CSP headers)
- Monitoring and alerting setup
- Known limitations

---

The full source document is at [`spec/SECURITY-MODEL.md`](https://github.com/ruachtech/rep/blob/main/spec/SECURITY-MODEL.md).