Sawabona Threat Model¶
Version: 2.0 Last Updated: 2026-01-28 Architecture: Single-Tenant Rust
This document identifies potential security threats to the Sawabona licensing platform and describes mitigation strategies.
Table of Contents¶
System Overview¶
Sawabona is a licensing and monetization platform built with Rust that:
- Validates software licenses via REST API (Actix-web)
- Manages payment provider integrations (7 providers: Stripe, Adyen, Flutterwave, PayStack, MercadoPago, PagSeguro, Braintree)
- Enforces license quotas and features
- Provides cryptographic proof validation (Geometric Proof system)
- Operates in single-tenant mode (default tenant: "default-tenant")
Architecture Components¶
- API Server (Actix-web, Rust)
- Database (PostgreSQL with SQLx)
- Payment Providers (Plugin-based, 7 providers)
- Cryptography (Geometric Proof, Argon2, AES-256-GCM, HMAC-SHA256)
- Client SDKs (
sawabona-sdk-rust,sawabona-sdk-py) - CLI (Rust-based administration tool)
Assets¶
Critical Assets¶
- License Keys: Unique identifiers for software licenses
- API Keys: Authentication credentials for API access
- Admin Credentials: Access to admin panel
- Customer Data: Email addresses, names, payment info
- Usage Data: Telemetry and usage statistics
- Cryptographic Keys: Geometric Proof keys, JWT secrets, encryption keys
Data Classification¶
- Highly Sensitive: API keys, admin credentials, cryptographic keys
- Sensitive: License keys, customer data
- Internal: Usage data, telemetry
- Public: Product information, pricing
Threat Actors¶
1. Malicious Users¶
Motivation: Bypass license restrictions, use software without paying
Capabilities:
- Reverse engineering
- Network traffic analysis
- License key sharing
- Automated attacks
2. Competitors¶
Motivation: Steal customer data, disrupt service
Capabilities:
- Advanced technical skills
- Resources for sustained attacks
- Social engineering
3. Script Kiddies¶
Motivation: Vandalism, reputation
Capabilities:
- Using existing tools
- Basic attacks (DDoS, SQL injection)
4. Insider Threats¶
Motivation: Financial gain, revenge
Capabilities:
- Internal system access
- Knowledge of vulnerabilities
- Legitimate credentials
Threat Scenarios¶
T1: License Key Theft¶
Description: Attacker steals valid license keys to use software without authorization.
Attack Vectors:
- Database breach
- Man-in-the-middle attack
- Social engineering
- Insider threat
Impact: HIGH
- Revenue loss
- Customer trust damage
- Legal liability
Mitigations:
- IP whitelisting (limits where keys can be used)
- Device fingerprinting (binds keys to specific devices)
- Concurrent session limits (prevents sharing)
- Encryption in transit (HTTPS)
- Encryption at rest (database encryption)
T2: License Key Sharing¶
Description: Legitimate users share license keys with unauthorized users.
Attack Vectors:
- Posting keys online
- Sharing with friends/colleagues
- Selling keys on black market
Impact: MEDIUM
- Revenue loss
- Quota abuse
Mitigations:
- Device fingerprinting
- Concurrent session limits
- IP whitelisting
- Usage monitoring and anomaly detection
- Automatic suspension on suspicious activity
T3: API Abuse¶
Description: Attacker floods API with validation requests to cause denial of service or discover valid keys.
Attack Vectors:
- Brute force attacks
- DDoS attacks
- Automated scanning
Impact: MEDIUM
- Service disruption
- Increased costs
- Potential key discovery
Mitigations:
- Rate limiting (per IP, per key)
- CAPTCHA for suspicious traffic
- API key authentication
- Request throttling
- Cloudflare/WAF protection
T4: Admin Panel Compromise¶
Description: Attacker gains unauthorized access to admin panel.
Attack Vectors:
- Credential stuffing
- Phishing
- Session hijacking
- Brute force
Impact: CRITICAL
- Full system compromise
- Data breach
- Service disruption
Mitigations:
- Two-factor authentication (2FA)
- Strong password requirements
- Session timeout
- IP whitelisting for admin access
- Audit logging
- Rate limiting on login attempts
T5: SQL Injection¶
Description: Attacker injects malicious SQL to access or modify database.
Attack Vectors:
- Unsanitized user input
- Vulnerable API endpoints
Impact: CRITICAL
- Data breach
- Data corruption
- System compromise
Mitigations:
- Compile-time checked queries (SQLx)
- Input validation via Actix-web extractors
- Least privilege database access
- Web Application Firewall (WAF)
- Regular security audits
- Rust's type system prevents many injection vectors
T6: Man-in-the-Middle (MITM)¶
Description: Attacker intercepts communication between client and server.
Attack Vectors:
- Unencrypted HTTP
- Compromised network
- DNS spoofing
Impact: HIGH
- License key theft
- Credential theft
- Data tampering
Mitigations:
- HTTPS/TLS enforcement
- Certificate pinning (optional)
- HSTS headers
- Secure DNS (DNSSEC)
T7: Reverse Engineering¶
Description: Attacker reverse engineers client SDK to bypass validation.
Attack Vectors:
- Decompilation
- Debugging
- Code analysis
Impact: MEDIUM
- License bypass
- Intellectual property theft
Mitigations:
- Server-side validation (never trust client)
- Geometric Proof cryptographic challenge-response
- Code obfuscation (limited effectiveness)
- Regular validation protocol updates
- Telemetry and anomaly detection
- Device fingerprinting and binding
T8: Insider Threat¶
Description: Authorized user abuses access to steal data or disrupt service.
Attack Vectors:
- Database access
- Admin panel access
- API key misuse
Impact: CRITICAL
- Data breach
- Service disruption
- Reputation damage
Mitigations:
- Principle of least privilege
- Audit logging
- Access reviews
- Background checks
- Separation of duties
- Monitoring and alerting
T9: Payment Provider API Key Compromise¶
Description: Attacker gains access to payment provider API keys stored in the system.
Attack Vectors:
- Database breach
- Memory dump attacks
- Unencrypted configuration files
- Insider threat
- Supply chain attack
Impact: CRITICAL
- Unauthorized transactions
- Financial fraud
- Customer payment data exposure
- Reputation damage
Mitigations:
- AES-256-GCM encryption at rest for API keys
- Environment variable storage (not in code)
- Vault integration for secrets management
- AWS Secrets Manager integration
- Least privilege database access
- Audit logging for key access
- Key rotation policies
- Webhook signature verification (HMAC-SHA256)
T10: Webhook Spoofing¶
Description: Attacker sends forged webhook events to manipulate payment status.
Attack Vectors:
- Replaying captured webhooks
- Forging webhook signatures
- Man-in-the-middle attacks
Impact: HIGH
- Fraudulent payment confirmations
- Revenue loss
- Customer disputes
Mitigations:
- HMAC-SHA256 signature verification for all webhooks
- Timestamp validation (prevent replay attacks)
- Webhook event ID tracking (prevent duplicates)
- HTTPS/TLS enforcement
- Rate limiting on webhook endpoints
- Webhook event logging and audit trail
Mitigations¶
Implemented¶
✅ Authentication & Authorization
- X-API-Key header authentication for admin endpoints
- JWT token validation for license operations
- Role-based access control (RBAC)
✅ Encryption
- HTTPS/TLS for all communications (enforced)
- AES-256-GCM encryption at rest for payment provider API keys
- Argon2 password hashing
- HMAC-SHA256 for webhook signature verification
- JWT signing with HS256
✅ Input Validation
- Serde deserialization with validation
- Actix-web extractors (type-safe request parsing)
- SQLx compile-time checked queries (prevents SQL injection)
✅ Rate Limiting
- Token bucket algorithm (100 req/sec default)
- Per-IP rate limiting
- Per-API-key rate limiting
- Configurable limits per endpoint
✅ Audit Logging
- All admin actions logged
- Payment webhook event logging
- License validation logging
- Immutable audit trail
✅ Cryptographic Security
- Geometric Proof system (cryptographic challenge-response)
- nalgebra for mathematical operations
- Secure random number generation
✅ Database Security
- SQLx compile-time query checking
- Parameterized queries (prevents SQL injection)
- PostgreSQL with SSL/TLS support
- Least privilege database user
✅ Payment Provider Security
- Plugin-based architecture (isolated provider code)
- Encrypted API key storage
- Webhook signature verification
- Provider health checks
- Webhook event deduplication
Planned¶
⏳ Advanced Security Features
- IP whitelisting per license
- Device fingerprinting and binding
- Concurrent session limits
- Two-factor authentication (2FA)
⏳ Advanced Monitoring
- Real-time anomaly detection
- Automated threat response
- Security dashboards
- Webhook delivery monitoring
⏳ Penetration Testing
- External security audit
- Vulnerability assessment
- Bug bounty program
Risk Assessment¶
| Threat | Likelihood | Impact | Risk Level | Status |
|---|---|---|---|---|
| T1: License Key Theft | Medium | High | HIGH | Mitigated |
| T2: License Key Sharing | High | Medium | MEDIUM | Mitigated |
| T3: API Abuse | Medium | Medium | MEDIUM | Mitigated |
| T4: Admin Panel Compromise | Low | Critical | HIGH | Mitigated |
| T5: SQL Injection | Low | Critical | LOW | Mitigated |
| T6: MITM Attack | Low | High | MEDIUM | Mitigated |
| T7: Reverse Engineering | High | Medium | MEDIUM | Partially Mitigated |
| T8: Insider Threat | Low | Critical | MEDIUM | Partially Mitigated |
| T9: Payment Provider API Key Breach | Low | Critical | HIGH | Mitigated |
| T10: Webhook Spoofing | Low | High | MEDIUM | Mitigated |
Security Improvements in Rust Implementation¶
The Rust implementation provides significant security improvements over the Python version:
- Memory Safety: Rust's ownership system prevents buffer overflows, use-after-free, and other memory safety issues
- Type Safety: Compile-time type checking prevents many classes of bugs
- SQL Injection Prevention: SQLx compile-time query checking catches SQL injection at compile time
- No GIL: Actix-web's async runtime provides better concurrency without Python's Global Interpreter Lock
- Performance: Rust's performance reduces attack surface from resource exhaustion
- Cryptography: Native Rust crypto libraries (nalgebra, AES-GCM, HMAC) with no FFI overhead
Last Updated: 2026-01-28 Next Review: 2026-04-28 Architecture: Single-Tenant Rust (Actix-web, SQLx, PostgreSQL)