CosmicClash/docs/THREAT-MODEL.md

# Cosmic Clash multiplayer threat model

This is the launch threat model for the control plane, dedicated servers and
clients. It records the security boundary and the verification owner for each
class of failure; it does not treat a trusted workload class as a trusted
individual pod.

| Threat | Prevention | Detection / response | Owner | Residual risk |
|---|---|---|---|---|
| Forged Steam identity or ticket | Backend calls Steam validation for the expected App ID; player ID comes from the verified SteamID mapping, never request JSON | Ticket rejection metrics, replay alerts, ban/revoke identity | Identity/API | Valve/Steam outage pauses new authenticated sessions |
| Ticket/session replay | Single-use ticket nonce; opaque short-lived session token; store token digest and revocation in PostgreSQL | Duplicate-ticket and revoked-session counters; incident revoke all sessions for identity | Identity/API | Stolen live session remains usable until expiry/revocation propagation |
| Queue/proposal flooding or duplicate claims | Body/rate limits, one active ticket partial unique index, idempotency keys, serializable participant fence | Per-identity/IP rate alerts, queue-depth and conflict dashboards, overload shedding | API/matcher | Distributed abusive identities can consume bounded capacity until automated bans act |
| Latency-evidence forgery | Opaque location, nonce/freshness checks, server-computed RTT, discrepancy quarantine; evidence affects placement only | Three-bad/five-clean counters and regional RTT SLO alerts | Matcher/networking | Colluding endpoints can bias placement within the accepted evidence window |
| Join-authorisation theft or slot hijack | Signed match-scoped authorisation binds verified SteamID/match/server/team/slot/protocol/expiry; server-owned generation fences old peers | Rejected-binding/generation metrics and audit events; revoke assignment | Allocator/game-server | A stolen valid authorisation remains usable until expiry unless the server revokes it |
| Forged or replayed match result | Bounded-lifetime (two-hour default) HMAC workload token delivered through the allocated GameServer annotation; backend resolves its allocation ID to the durable match/server binding; canonical digest | Receipt conflict is inert and pages; duplicate is idempotent; result lag alerts at 5/30 minutes | Result/maintenance | A compromised authoritative pod, or a principal able to read its allocated GameServer metadata before expiry, can submit for that allocation |
| Workload/insider compromise | Per-workload service accounts, least RBAC, private stores, default-deny network, no publisher/root key in game pods; restrict GameServer metadata read access to the allocator and cluster operators | Credential-use audit, anomalous allocation/result pairing alerts, immediate workload drain/revoke | Platform/security | Cluster-admin/KMS compromise, or an authorized metadata reader acting before token expiry, is outside application controls |
| Gameplay/API DDoS and flood | Connection/body/WebSocket limits, token buckets, overload shedding, edge WAF/DDoS service, live-result priority | Saturation, 5xx, tick-backlog and dropped-work dashboards; shed new queue/allocation work first | SRE/platform | Volumetric attack may require provider mitigation capacity |
| SDR signing-key theft | Offline CA separated from online signer; non-exportable KMS/HSM key; signer allowlist and short-lived tickets | Signer audit and anomaly alerts; rotate/revoke certificates and tickets | Security/networking | Provider/Valve trust or HSM compromise requires external response |
| Dependency/image supply chain | Pin image/dependency digests, SBOM, vulnerability scan, artifact signature and admission verification | CI/admission failures and provenance inventory; critical-fix SLA | Release/security | Unknown zero-days remain possible until detection or patch |
| Denial of wallet / autoscaling abuse | Allocation quotas, budgets, warm-capacity limits, per-identity/IP controls and scale ceilings | Cost-per-match, allocation-rate and quota alerts; disable region/playlist safely | SRE/finance | Legitimate launch spikes can trigger conservative limits |
| Data loss or cache inconsistency | PostgreSQL backups/RPO <=5m, serializable transactions, transactional outbox; Redis is rebuildable only | Restore/failover rehearsal, cache-repair metrics, result reconciliation | Data/SRE | Recovery can pause new work; valid live matches must continue |

## Trust boundaries

- Clients are untrusted and cannot submit ratings, outcomes, penalties,
  allocation state or exemptions.
- Game servers are authoritative for simulation but are not trusted for
  identity, allocation ownership, or unrestricted result submission.
- PostgreSQL is the durable authority. Redis and Agones annotations are
  recoverable transport/cache state.
- The offline SDR CA and online leaf signer are separate; API, matcher,
  allocator and game-server workloads cannot read signer keys.

Every accepted residual risk above has an owner and a planned detection path.
Security incidents fail closed for identity/result ownership. An allocated
server remains in its results state and retries its idempotent result request
until the control plane durably acknowledges it; it does not exit first and
silently lose the authoritative outcome.