AGS — Security & Privacy Threat Model

Security & Privacy Threat Model src/services/auth.py

The main privacy/security risks and how AGS reduces them.

Risk	Mitigation	Residual concern
Direct participant identification	Phone stored only as HMAC token; study IDs used for analysis.	HMAC secret must remain protected.
Overcollection	Collect interaction signals, not video or credentials.	External pages may still contain sensitive visible content.
Unauthorized dashboard access	Researcher JWT, role checks, admin-only routes.	Passwords and JWT secrets need operational protection.
Condition leakage	Condition resolved server-side and hidden from participant UI.	Facilitator language can still bias participants.
Data tampering	Server-side validation, audit log, schema constraints.	Admin actions still require review discipline.
Replay/duplicate events	Idempotency via client_event_id.	Offline queues need monitoring for delayed batches.
Third-party site breakage	Proxy/extension fallback and explicit capture-mode metadata.	Some sites may still be incompatible.

JWT_SECRET, RESEARCHER_JWT_SECRET, and PHONE_HMAC_SECRET must be separate.
Rotating JWT secrets should not break phone reauth if the phone HMAC secret remains stable.
Environment variables live in deployment secrets, not source code.