Security, Threat Modeling, and the Software Supply Chain
Backend security is a continuous engineering process: understand assets and trust boundaries, reduce attack surface, authenticate and authorize every effect, validate untrusted input, protect secrets, patch dependencies, detect abuse, and rehearse response. AI adds prompt injection, model supply chain, unsafe output, tool agency, data leakage, and denial-of-wallet risks.
What will you be able to do?
- create a data-flow threat model;
- map OWASP API and LLM risks to concrete controls;
- secure secrets, outbound requests, dependencies, and containers;
- build audit and incident response for compromised credentials or tools.
How do you threat-model SupportDesk AI?
Draw clients, API, identity provider, PostgreSQL, Redis, queue, workers, object storage, vector index, model providers, MCP servers, tools, telemetry, and administrator interfaces. Mark trust boundaries and data classes. For each flow ask:
- Can identity or data be spoofed or tampered with?
- Can an action be replayed or repudiated?
- Can private information be disclosed?
- Can capacity or money be exhausted?
- Can privilege be escalated?
- Can the component or dependency be replaced maliciously?
Track threats as owned engineering work with severity, controls, tests, evidence, and residual risk.
Which baseline controls matter?
- TLS and secure proxy/header configuration.
- Standards-based authentication and resource authorization.
- Parameterized SQL and safe output encoding.
- Explicit CORS allow-list; CSRF defense for cookie authentication.
- Request, body, file, decompression, pagination, timeout, and concurrency limits.
- Outbound network allow-list and SSRF-safe URL resolution where fetching is required.
- Secret manager, workload identity, rotation, redaction, and break-glass audit.
- Non-root, minimal, patched containers with read-only filesystem where practical.
- Lockfile review, vulnerability scanning, provenance/SBOM, protected CI, and signed artifacts where supported.
- Tamper-evident audit records for identity, permission, approval, tool, export, and admin events.
How does AI change the threat model?
Treat user prompts, retrieved documents, tool results, model output, model files, plugins, and MCP servers as untrusted. System prompts are not secret vaults or authorization layers. Enforce tool permissions in code, cap spend, detect exfiltration patterns, isolate risky parsers/code, and red-team indirect prompt injection.
What happens when a secret leaks?
Revoke/rotate immediately, disable affected paths if needed, preserve evidence, identify scope through audit, notify according to obligations, remove the secret from active configuration and history, test the replacement, and document root cause. Never wait for a code cleanup before revocation.
Common mistakes
- CORS wildcard combined with credentials.
- Trusting X-Forwarded-For from any client.
- Model can fetch arbitrary URLs, enabling SSRF and cloud metadata access.
- Dependency scanner warnings are ignored without risk ownership.
- Secrets are masked in UI but still returned by API.
- Audit log is editable by the same runtime principal it monitors.
AI Pair-Programmer Prompt
Exercise
Create a threat model for the RAG plus refund-tool feature. Include a malicious document, stolen user token, compromised MCP server, dependency takeover, and budget exhaustion.
Acceptance criteria: each threat maps to preventive, detective, and responsive controls plus a test; consequential effects cannot occur from document instructions; residual risks have owners.
Knowledge check
- Is a system prompt a secret or authorization control?
- What is the first action after credential exposure?
- Why restrict outbound network access?
Answers
- No.
- Revoke or rotate the credential and contain the path.
- To reduce SSRF, exfiltration, and unintended service access.
Completion checklist
Primary references