New crates/apps/nigig-email/THREAT_MODEL.md. Separate from the root
THREAT_MODEL.md, which is Nigig-Pay's and shares no assets with this
feature.
Nine threats with the control named for each, so a reader can check the
claim rather than take it on trust. The two that matter:
T-E2 (password leaked by our own code) was LIVE, not hypothetical --
SmtpConfig derived Serialize over a plaintext String and the whole
struct was POSTed on wasm.
T-E7 (DoS via a hostile message) is the SMS A3 bug class. One inbound
message containing emoji took down the SMS list on every frame until it
was deleted; email bodies are more hostile, not less.
Sections that exist specifically to avoid overclaiming:
* "Residual" notes on every mitigation. Secret does not zero on drop.
We trust the platform root store; no certificate pinning. Header
injection is handled by lettre, NOT by us -- which means the C1d proxy
backend, which does not go through lettre, must sanitise or T-E4
becomes unmitigated.
* "What has not been tested": no live SMTP server has been contacted,
the wasm path has never been built, and no IMAP code exists, so
T-E1/T-E2 cover the SMTP direction only.
* Four open risks ranked, each tied to a plan item, including two
(proxy auth, keystore storage) that MUST land with C1d/C1f rather
than after -- the proxy is only safer than on-device IMAP if its token
is revocable and scoped.
Marks A1-A6 done in the plan. Phase A is complete.
