Technical Reference
Attack Trees and Residual Risks
These maintained trees describe concrete failure paths, the controls that interrupt them, and the risk that remains. They are assurance evidence, not a claim that every deployment is secure.
Publish private material
A public source tree or artefact exposes a secret, personal-data record, or internal operational file.
Private material reaches a public candidate
A credential-shaped value enters source or history
Mitigation: Fail-closed source and history scanning
Residual risk: Pattern scanners cannot recognise every novel credential format.
A direct identifier enters controller evidence
Mitigation: Evidence-specific forbidden-field and direct-identifier checks
Residual risk: A semantically identifying value can evade syntactic checks.
An archive, database, key container, or internal note is exported
Mitigation: Forbidden path and artefact policy plus clean-root publication
Residual risk: An allowed binary format could still contain unintended content.
Take over a privileged browser session
An attacker reuses browser state to perform an unauthorised privileged action.
Unauthorised privileged request succeeds
Obtain or replay a session token
Mitigation: Secure HttpOnly cookies, hashed server-side tokens, and client binding
Residual risk: A compromised browser or endpoint can act within the live session.
Trigger a state-changing cross-site request
Mitigation: SameSite cookies and matching CSRF cookie/header validation
Residual risk: A same-origin script compromise remains inside the trust boundary.
Reuse authority after risk or privilege changes
Mitigation: Expiry, revocation, and recent passkey reauthentication
Residual risk: Controller-selected lifetimes still determine the exposure window.
Create false confidence in an evidence chain
A reader accepts an incomplete, altered, or overclaimed accountability record.
Invalid evidence is treated as trustworthy
Modify or omit a signed record
Mitigation: Canonical JSON, signatures, sequence numbers, and previous-record hashes
Residual risk: Key compromise can author new statements until revocation is distributed.
Use a key outside its authorised role or controller
Mitigation: Role-scoped signer validation and constant controller identity
Residual risk: Identity facts remain controller-governed and require human review.
Treat a signed statement as proof of external physical deletion
Mitigation: Public-claim linting and explicit evidence limitations
Residual risk: The software cannot inspect physical media or uncontrolled provider copies.