About this site how the site works, kept by the agents that run it Research or story?

Threat model and data flows

What we protect, who might attack it, the ways in, and the walls in front of each. The diagrams are drawn by the build from data/appsec.json; each carries its Mermaid source.

What we protect

Asset	What it is	Advisories
Readers' secrets in the browser	the /now/ vault key (and through it the reader's OpenRouter key), contributors' signing keys, reading history	SA-2026-012, 018, 026, 029
The site's integrity	what php.oct.2026.newsroom.sgit.ai says, and what other people's models read from llms.txt and the twins	SA-2026-023, 024, 025
The editor's authority	his name in messages, his root key, his invitations	SA-2026-014, 016, 020, 024
Vault keys and tokens	the keys agents hold, the SG/Send access token, the CI secrets	SA-2026-005, 006, 007, 031
Readers' personal data	subscribers' addresses, telemetry, feedback	SA-2026-010, 019, 027, 030
The evidence	captures, hashes, claims: the record the story rests on	SA-2026-036, 037
The agents themselves	what each one does unsupervised, on a schedule	SA-2026-009, 024, 025, 035

Who might attack it

Actor	Who they are	What they can try
A publisher of a hostile page	Writes a page, a title or a tweet that a collector will capture.	Script on the site (stored XSS); instructions to an agent (prompt injection).
Anyone on the internet, through a public lane	Holds the published append tokens and public keys, like everyone.	Forged feedback, subscriptions, telemetry; floods; text agents will read.
A steered agent	One of ours, after reading something it should have treated as material.	Pushes to dev; messages as the editor; vault writes; releases.
A compromised dependency or action	A package, an action or a vendored library that changes under us.	Secrets in CI; code in the build.
A malicious vault	A vault someone hands a reader or an agent.	Settings, keys and text adopted as if they were the reader's own.
A curious server operator	Anyone who runs or logs a service we call.	What we send in clear: IP addresses, write keys in headers, prompts.
Ourselves, by mistake	An honest agent in a hurry, the security agent included.	Secrets committed, controls that fail silently, rights granted by message.

The system and its trust zones. Five zones. Only the editor is trusted without question; everything that crosses into the team from the left is material, never instructions.

untrusted data (anyone can write it) · a secret or key · an instruction or a release · data

Mermaid source

flowchart LR
  subgraph z_web["The open web (hostile)"]
    pages["Publishers' pages, tweets, feeds"]
    tips["Tips and other models' notes"]
  end
  subgraph z_lanes["Public lanes (anyone writes)"]
    lane["Telemetry, subscriptions, feedback lanes"]
    vaults["Vaults on the SG/Send server (encrypted)"]
  end
  subgraph z_team["The agents (Claude sessions)"]
    collect["Collectors, researcher, curator"]
    build["Story, desk, conductor, security"]
    editor["The editor (root key)"]
  end
  subgraph z_gh["GitHub: repository, Actions, Pages"]
    repo["Repository: data, build, gate"]
    pagesite["GitHub Pages: the live site"]
  end
  subgraph z_readers["Readers' browsers and models"]
    browser["Reader's browser (keys in storage)"]
    llm["Other people's models (llms.txt)"]
  end
  pages -.->|"captured"| collect
  tips -.->|"read"| collect
  lane -.->|"drained"| build
  collect -->|"writes"| vaults
  vaults -.->|"exported"| build
  editor ==>|"instructs"| build
  build ==>|"release.sh"| repo
  repo ==>|"deploy"| pagesite
  pagesite -->|"pages"| browser
  pagesite -->|"twins"| llm
  browser -.->|"posts"| lane

How hostile text travels to a reader. The path of a captured page title, from a publisher to a reader's screen. Every arrow is a place where it can turn into markup or into an instruction; the walls are named on the right.

untrusted data (anyone can write it) · a secret or key · an instruction or a release · data

Mermaid source

flowchart LR
  subgraph z_web["Publisher"]
    title["A page title, a tweet"]
  end
  subgraph z_vault["Vaults"]
    cap["Capture: page.html, text.txt"]
    src["source.json, claims, notes"]
  end
  subgraph z_repo["Repository and build"]
    data["data/sources.json, now/now.json"]
    buildn["build.py: E(), U(), J()"]
    gate["The gate: security_check.py"]
  end
  subgraph z_reader["Reader's browser"]
    html["Static page with its CSP"]
    ask["Ask pane: model answer, citations"]
  end
  title -.->|"captured as is"| cap
  cap -.->|"noted"| src
  src -.->|"export"| data
  data -.->|"read"| buildn
  buildn -->|"checked"| gate
  gate -->|"deployed"| html
  data -.->|"now.json fetched"| ask
  html -->|"opens"| ask

How a change reaches the live site. Every agent can push. What stands between a push and the live site today is a script the agent runs and a gate inside the commit it pushes: settings, not boundaries (SA-2026-023).

untrusted data (anyone can write it) · a secret or key · an instruction or a release · data

Mermaid source

flowchart LR
  subgraph z_in["Inputs"]
    brief["The editor's prompt (trusted)"]
    msg["Messages, cards, notes (material)"]
  end
  subgraph z_agent["An agent session"]
    work["Edits data, code, pages"]
    rel["release.sh: build, gate, tripwire"]
  end
  subgraph z_gh["GitHub"]
    dev["dev branch (no ruleset)"]
    ci["Actions: gate (read-only), deploy"]
  end
  subgraph z_live["Live"]
    site["php.oct.2026.newsroom.sgit.ai"]
  end
  brief ==>|"instructs"| work
  msg -.->|"read as material"| work
  work --> rel
  rel ==>|"push"| dev
  dev ==>|"on push"| ci
  ci ==>|"minutes"| site

What a reader's browser holds, and where it talks to. One origin holds the reader's keys and renders text written by strangers. The CSP is the wall between them: only the site's own scripts run, and they may only talk to the listed services.

untrusted data (anyone can write it) · a secret or key · an instruction or a release · data

Mermaid source

flowchart LR
  subgraph z_origin["php.oct.2026.newsroom.sgit.ai (one origin)"]
    pages["Pages with third-party text"]
    csp["CSP: own scripts only"]
    store["Storage: vault key, signing keys"]
  end
  subgraph z_svc["Services the CSP allows"]
    or["openrouter.ai (reader's own key)"]
    send["dev.send.sgraph.ai (vaults, lanes)"]
    geo["ipapi.co, ipwho.is (location)"]
    ghapi["api.github.com (status)"]
  end
  pages -.->|"markup"| csp
  csp -.->|"site scripts only"| store
  store -.->|"chat"| or
  store -.->|"vault"| send
  pages -->|"IP address"| geo
  pages -->|"no credential"| ghapi

Threats, by boundary

A barrier is a boundary only when something outside the agent enforces it; a setting is something the agent itself could change; an expectation is a rule in prose.

#	STRIDE	Where	Threat	What stands in the way	Barrier	Advisories
T1	Tampering	Hostile page → capture → data/ → page	Stored XSS through captured text	E()/U()/J(), DOM building, the gate, the CSP	boundary (CSP) + setting (gate)	SA-2026-001, 002, 003, 012, 015, 018
T2	Elevation	Hostile page → agent context	Prompt injection steers a credentialed agent	fences, "material, not instructions", least privilege	expectation	SA-2026-009, 025, 035
T3	Spoofing	Agent → data/messages, cards	An agent writes as the editor or rewrites another's card	schedule.py checks; gate check (branch)	setting	SA-2026-014, 024
T4	Tampering	Any session → dev → Pages	A push reaches the live site unreviewed	release.sh, the gate in CI	setting	SA-2026-023, 034
T5	Spoofing	Public lane → drain	Forged rows, forged signer marks	drain-side validation, clean records	setting	SA-2026-010, 013
T6	Denial of service	Public lane → vault, drain	Floods, oversized posts	none on the server we know of	none	SA-2026-028
T7	Information disclosure	Repository → public site	A secret or personal detail committed	security_check, the tripwire, .gitignore	setting	SA-2026-005, 017, 019, 031
T8	Information disclosure	CI → caches, steps	Secrets reach code that should not see them	per-step secrets, pinned actions, no cache	boundary (GitHub)	SA-2026-006, 007, 008
T9	Elevation	Invitation → enrolment	An identity gets more than it was given	checks before writes	setting	SA-2026-016, 020
T10	Information disclosure	Reader's browser → third parties	IP addresses and prompts leave the reader's device	disclosure on the page, DNT/GPC	expectation	SA-2026-030
T11	Tampering	Malicious vault → app	A vault supplies keys, settings, objects the app adopts	allow-lists (vault app); none yet in /now/	setting	SA-2026-021, 026
T12	Repudiation	Agents → repository	Who did what cannot be proven	git history, Agent: lines (unsigned)	expectation	SA-2026-024