# Security Policy
## Albert Lane · albertlane.net · Digital Fraud Audit Series
### SEC Whistleblower No. 17684-273-411-436

---

## Scope

This policy covers two independent Cloudflare Workers deployed under albertlane.net:

| Worker | Name | Route | Database |
|--------|------|-------|----------|
| Sovereign Audit | `sovereign-plugin` | `albertlane.net/*` | `sovereign-phoenix` D1 |
| FROI Vault | `alnet-froi` | `albertlane.net/vault/api/*` | `alnet-froi-db` D1 |

Note: The legacy `d1-rest` worker (`index.ts`, `wrangler.d1rest.toml`) is superseded by `sovereign-plugin` and is scheduled for removal. Do not extend it.

---

## Architecture

`sovereign-plugin` is a plain Cloudflare Worker (`workers/sovereign-worker.js`) backed by:
- **ASSETS** binding — static file serving from `public/` (index, FaaF, FPSA, RA, Vault UI)
- **PHOENIX_DB** — D1 `sovereign-phoenix` forensic audit database
- **SOVEREIGN_CACHE** — KV rate-limit + block-list cache
- **AI** — Cloudflare AI binding (LLaMA 3 8B)

All `/api/*` requests pass through the HMAC-SHA256 middleware in the Worker before reaching any handler. Static assets are served directly via the ASSETS binding — no middleware overhead.

---

## Data Ownership

Users retain full rights over all submitted content. No data is sold, licensed, or shared with third parties.

## Non-Harvesting (FROI Vault)

The FROI Vault (`alnet-froi` worker) uses the **Google Gemini API** (`gemini-2.0-flash` via `generativelanguage.googleapis.com`) exclusively, as of 2026-05-22. The previous OpenAI integration has been removed.

**Gemini data handling:** Google's Gemini API does not expose a `store: false` parameter equivalent to OpenAI. Data retention for API requests is governed by Google's AI Studio / Google Cloud project settings. To minimise data retention:
- Disable "Improve Gemini Apps" in Google AI Studio project settings.
- Use the API key under a project with data protection terms enabled.
- The worker does not send user identity or session IDs to the Gemini API — only the processed incident text and up to 2000 chars of prior context.

The Cloudflare Durable Object session handler persists conversation content only in the user's own `alnet-froi-db` D1 record under their session ID. No conversation data is shared with third parties beyond the Gemini API call.

## Encryption

- All data in transit is encrypted via TLS 1.3 (enforced by Cloudflare).
- Evidence files stored in R2 (`alnet-froi-evidence`) are encrypted at rest by Cloudflare (AES-256).
- D1 databases are encrypted at rest.

## Access Control

- All `/api/*` endpoints require HMAC-SHA256 handshake token via `x-sp-token` header (30-second rolling window).
- Admin endpoints (`/api/threats`, `/api/access-log`, `/api/internal/ping`) additionally require `X-Admin-Token` header with constant-time comparison.
- WebSocket connections to the FROI Durable Object are session-scoped — each session ID maps to an isolated DO instance.

## Rate Limiting and Blocking

- Sovereign worker: sliding window rate limiter via D1 `rate_state` table; auto-block at threshold via `blocked_ips` table and KV cache. Fail-closed design — if D1 is unavailable, all `/api/*` requests are blocked.
- FROI worker: jitter applied to all responses to prevent timing attacks.
- Response jitter: 8–40 ms on all sovereign exit paths to prevent timing oracle attacks.

## No Zero-Trust Conflicts

The two primary workers operate on separate routes (`albertlane.net/*` vs `/vault/api/*`) and separate D1 databases. There are no shared tables, shared KV namespaces, or shared R2 buckets between them.

## Vulnerability Reporting

Do not open public issues for security vulnerabilities. Contact the project owner privately:

**Email: security@albertlane.net**  
**Encryption: https://albertlane.net/.well-known/pgp-key.txt**

Include:
- Affected component and version
- Steps to reproduce
- Impact assessment
- Suggested mitigation

## Responsible Disclosure

We will acknowledge reports and work with reporters to remediate. Do not publish exploit details until a fix is available and deployed. 90-day disclosure timeline.

## Secrets Rotation

- Rotate all secrets after any exposure event.
- Use `wrangler secret put` — never commit secrets to the repository.
- Short-lived tokens only for CI/CD automation.

## Required Secrets

| Secret | Worker | Purpose |
|---|---|---|
| `HANDSHAKE_SECRET` | sovereign-plugin | HMAC signing key |
| `ADMIN_TOKEN` | sovereign-plugin | Admin endpoint gate |
| `AUTH_TOKEN` | sovereign-plugin | Legacy bearer token (scheduled for removal with d1-rest) — confirm unused before deleting |
| `FROI_GEMINI_KEY` | alnet-froi | Google Gemini API key (renamed from FROI_AI_KEY on 2026-05-22) |

## Sensitive Files Policy

- The `.private/` directory is excluded from git tracking (added 2026-06-02).
- Files in `.private/` that were committed before 2026-06-02 remain in git history and **must** be purged using `git filter-repo --path .private/ --invert-paths` followed by a force-push to all branches.
- Federal evidence documents and fraud investigation data must be stored in encrypted offline storage, not in any git repository.

## Hardening Checklist

- Revoke any tokens accidentally committed immediately.
- Enable Cloudflare WAF managed rules and OWASP ruleset before opening public endpoints.
- Use signed R2 URLs (generated by Workers) for all evidence asset access.
- Enforce HMAC handshake validation and rate limits for all `/api/*` endpoints.
- Review `security-reports/` after each daily security workflow run.
- Merge `Development` to `main` only after reviewing the daily optimization report.
- Monitor `/api/internal/ping` (admin-gated) to verify D1 and KV health after each deploy.
- Enable branch protection on `main` with required status checks before merging any PR.
- Run `git filter-repo --path .private/ --invert-paths` to purge sensitive historical files.