Threat Model (STRIDE)

Scope

TableTime platform: API, bot, web, WS, data stores.

STRIDE Matrix

Threat	Компонент	Риск	Митигация
S Spoofing	API	Подделка player_id	JWT/Guest token, server-side participant resolve
S Spoofing	Telegram	Fake callback	Verify telegram_id via Bot API session
T Tampering	Actions	Подмена хода	Server validate; signed tokens; HTTPS
T Tampering	State	Client-side dice	CSPRNG on server only (FR-035)
R Repudiation	Games	Отказ от хода	Append-only audit log (FR-032)
I Info Disclosure	API	Утечка email	Minimize PII in responses; RBAC
I Info Disclosure	WS	Подписка на чужую game	Auth on subscribe, topic ACL
D Denial of Service	Join	Flood codes	Rate limit (NFR-012)
D Denial of Service	WS	Connection flood	Max connections per IP
E Elevation	Session	Guest → host	Role check on host actions
E Elevation	Kick	Non-host kick	host_participant_id verify

Attack scenarios

AS-01: Brute invite codes

• Risk: Medium
• Mitigation: 6–8 char alphanumeric ≈ 30+ bits; rate limit; lockout

AS-02: Replay action

• Risk: Medium
• Mitigation: action_id idempotency (FR-027)

AS-03: MITM on WS

• Risk: High without TLS
• Mitigation: WSS only in prod (NFR-013)

AS-04: Token theft

• Risk: Medium
• Mitigation: Short JWT TTL, httpOnly refresh cookie on web

Data classification

Data	Class	Storage
password_hash	Sensitive	PostgreSQL encrypted at rest
JWT secret	Secret	Env/vault
BOT_TOKEN	Secret	Env only
Game state	Internal	PostgreSQL/Redis
Display names	Public	PostgreSQL

Compliance note

Fan project — GDPR-style deletion: user may request account delete (Phase 3).