Phase 16: Security and Hardening

This phase is still ahead.

Ships

v0.16.0

Lesson

Threat modeling, fuzzing and abuse prevention

Depends on

Phase 15

• docs/design/threat-model.md: assets, attackers, entry points (WebSocket, HTTP APIs, admin tools, the host) and mitigations.

• Fuzz targets for every message handler (envelope decoding is fuzzed from Phase 2), run briefly in CI and for an hour nightly.
• Limits everywhere (connections per IP, messages per second, message size, pending inputs, names, chat length), each with a test.
• Authority audit: every client message type reviewed for trust assumptions, with findings fixed.
• Review the Phase 2 slow-client, idle and handshake timeouts against real traffic; origin checks and TLS-only connections in production.
• Server-side anomaly logging (speed, impossible actions, abnormal rates) with an admin report.

• Session expiry and revocation, “log out everywhere” and password change.
• Self-service account deletion that honors the privacy policy.
• Least-privilege database roles, verified encrypted backups, and secrets rotated with the process documented.

• Host audit (open ports, services, users, SSH, updates, file permissions) with findings fixed and documented.
• Automated dependency updates (Renovate or Dependabot) for the Go modules (server and web), the art tools’ Python lockfile and GitHub Actions, plus govulncheck in CI.

• docs/walkthroughs/phase-16-security.md: the threat model, fuzzing and the authority audit.
• Devlog draft, release notes, tag v0.16.0 and publish builds.

• Fuzzers run for an hour with no crashes.
• Every threat in the model has a mitigation or an accepted risk with a reason.
• No known vulnerabilities in dependencies.