Threat Model: Customer Document Upload

Consensus

The board concurs that the threat model exposes critical SSRF risk via the URL fetcher, high‑risk unsandboxed image/OCR processing, insecure long‑lived presigned URLs, absent malware scanning, and insufficient audit visibility. Immediate isolation, sandboxing, URL hardening, and improved logging are required.

Findings

Dissent — recorded, not resolved

Recommendations — ranked, not scored

1. now Isolate the fetcher in a dedicated subnet, block private IP ranges, enforce an outbound allow‑list, and log full request details to mitigate SSRF.
2. now Run ImageMagick/Tesseract inside hardened containers or sandboxes, add magic‑byte content sniffing, and integrate automated malware scanning for all uploads.
3. now Replace 7‑day presigned URLs with short‑lived (<1 hour) tokens generated on‑demand, deliver them via an authenticated portal, and implement a revocation list.
4. next Introduce document‑level access controls and extend audit logs to record source URLs, download events, and hash verification results.

Coverage

• network security — partial. No allow‑list or subnet isolation for fetcher; SSRF controls missing.
• execution environment — partial. Processing binaries run unsandboxed; lacks containerization and seccomp profiles.
• access control — partial. Long‑lived presigned URLs and claim‑level ACLs only; no revocation or document‑level granularity.
• observability — gap. Fetcher source URLs not logged; audit trail lacks download and integrity verification details.

Bottom line

The decision is whether this security threat model is sufficient to support deployment or continued operation; it is not sufficient in its current form. The review identified critical SSRF exposure and multiple high-risk weaknesses that could enable internal-service access, remote code execution through uploaded files, and prolonged unauthenticated access to sensitive documents.

A score of 58/100 indicates serious deficiencies in the document's represented security posture, including missing or inadequate controls in core attack surfaces. Proceeding without addressing these findings would leave material, known exposures unresolved.

Key points

• The URL fetcher permits arbitrary outbound requests and redirects without private-IP validation, creating a critical path to internal services and metadata endpoints.
• ImageMagick and Tesseract process extension-validated uploads as unsandboxed subprocesses, exposing workers to crafted-file exploitation and potential remote code execution.
• Seven-day, non-revocable presigned URLs sent by plaintext email provide unauthenticated recipients extended access to sensitive documents.
• Uploads receive no malware or virus scanning, leaving handlers and processing systems exposed to malicious or zero-day document payloads.
• Audit records omit fetcher source URLs, download activity, and integrity-verification results, while claim-level access controls do not provide document-level protection.
• Network security, execution isolation, access control, and observability are all assessed as incomplete, with observability specifically identified as a gap.

What to do

1. Immediately isolate the fetcher in a dedicated subnet, block private IP ranges, enforce an outbound allow-list, and log complete request details.
2. Immediately run ImageMagick and Tesseract in hardened containers or sandboxes, add magic-byte content validation, and scan every upload for malware.
3. Immediately replace seven-day presigned URLs with on-demand tokens valid for less than one hour, delivered through an authenticated portal with revocation capability.
4. Next, implement document-level access controls and extend audit logging to capture source URLs, download events, and hash-verification results.

Where reviewers disagreed

One reviewer assessed the SSRF issue as medium severity, while the majority assessed it as critical. This matters because the majority conclusion reflects the fetcher's ability to reach internal services and metadata endpoints without IP-range validation or outbound restrictions.