Threat Model for a System or Change

Wrote docs/architecture/tasks/pay-checkout-sec-001/threat-modeling-task/threat-model-report.md. Complete threat model evaluating the Guest Checkout payment flow under STRIDE, establishing OTP rate-limiting, token scoping, and 10-minute expiration mitigations.

---
skill: threat-modeling-task
---

# Threat Model Report: Guest Checkout One-Click Payment [TM-PAY-001]

## Summary

This threat model evaluates the security posture of the Guest Checkout One-Click Payment feature in `checkout-service v3.5.0` under run ID `pay-checkout-sec-001`. The feature introduces frictionless payment processing for unauthenticated users via SMS and email OTP tokens. The analysis evaluates threat vectors across the public API gateway, SMS/email delivery channels, and Redis cache. It decisively rejects the product proposal for a 24-hour OTP window due to high risk of SIM-swap exploitation and brute-force token harvesting. It specifies mandatory mitigations: 10-minute OTP expiration, 3-attempt brute-force lockouts, cryptographic device-session binding, and downstream payment token masking.

## Detailed Description

Guest checkout paths represent high-risk attack surfaces because transactions execute without pre-existing authenticated user sessions. Stored Stripe payment method tokens must never be disclosed or charged without verifiable proof of possession of the guest identifier.

### Criteria and weights

| Criterion | Why it matters here | Weight | Source of the weight |
|---|---|---|---|
| Financial Abuse & Fraud Prevention | Stolen OTP tokens allow attackers to charge victims' cards for guest orders. | 0.40 | Sarah Chen (AppSec Lead) |
| Credential Harvesting Defense | SMS and email channels are vulnerable to interception, SIM-swapping, and phishing. | 0.30 | SecOps Threat Intelligence |
| Friction & Conversion Impact | Security controls must not prevent legitimate guest customers from completing purchases. | 0.15 | Alex Mercer (Product Lead) |
| Regulatory & PCI Compliance | Exposing raw payment identifiers violates PCI-DSS requirements. | 0.15 | Corporate Compliance Policy |


### Comparison

| Design Option | OTP Lifetime | Brute-Force Safeguard | Session Binding | Residual Risk Level |
|---|---|---|---|---|
| Option A: 24h Permissive OTP (Product) | 1,440 minutes (24 hours) | None | None (link alone authorizes charge) | Critical: Vulnerable to link theft, forward interception, and SIM-swap fraud. |
| Option B: 30-min Standard OTP | 30 minutes | IP-based rate limiting | User-Agent match | Medium: IP rotation easily bypasses rate limiter; User-Agent is easily spoofed. |
| Option C: 10-min Hardened OTP (Chosen) | 10 minutes (600 s) | Max 3 attempts per phone/email hash | Cryptographic Cookie / Device Fingerprint | Low: Strict attempt caps eliminate brute force; short window bounds SIM-swap exposure. |


### Result

Option C is selected. The guest checkout token lifecycle is restricted to 10 minutes with strict per-identifier rate limiting.

---

### Required Mechanisms

#### 1. System Boundary and Assets at Risk [MC-AS-01]
- **Assets**:
  - `Stripe Vault Token`: Token authorizing payment against stored cardholder data.
  - `Customer PII`: Guest email address, mobile phone number, delivery address.
  - `Financial Balance`: Customer monetary funds exposed to fraudulent charges.
- **Trust Boundaries**:
  - External Internet -> API Gateway (`POST /v1/checkout/guest/pay`).
  - API Gateway -> Internal Redis Token Cache.
  - Checkout Service -> External Third-Party Telephony (Twilio SMS / SendGrid Email).

#### 2. STRIDE Threat Hypotheses & Abuse Scenarios [MC-TH-01]

##### THR-01: Spoofing / Account Takeover via OTP Brute-Force (STRIDE: Spoofing)
- **Vulnerability**: 6-digit numeric OTP space contains 1,000,000 combinations. Without rate limits, automated bots can brute-force codes within 24 hours.
- **Mitigation**: Redis counter tracks failed validation attempts for `(phone_hash, checkout_id)`. After 3 failed attempts, the OTP token is immediately destroyed, and the checkout session is locked.

##### THR-02: Tampering / Man-in-the-Middle on SMS Delivery (STRIDE: Tampering)
- **Vulnerability**: Plain SMS delivery is susceptible to SS7 interception and carrier SIM-swapping.
- **Mitigation**: SMS messages contain only an alphanumeric verification code, never a direct one-click charge link. The checkout UI requires concurrent entry of both the SMS code and a confirmation of the billing zip code.

##### THR-03: Information Disclosure of Stored Payment Method (STRIDE: Information Disclosure)
- **Vulnerability**: Successful OTP validation returning raw card details or unmasked cardholder names.
- **Mitigation**: API responses return strictly masked card representations (`brand: VISA, last4: 4242`). The Stripe vault token remains internal to backend service-to-service calls.

##### THR-04: Denial of Service via Telephony Pumping (STRIDE: Denial of Service)
- **Vulnerability**: Attackers trigger millions of guest OTP requests to generate fraudulent SMS toll fees (SMS pumping attack).
- **Mitigation**: Ingress Cloudflare Turnstile CAPTCHA enforced on `POST /v1/checkout/guest/request-otp`. Global IP rate limit capped at 5 OTP requests per hour per IP.

##### THR-05: Elevation of Privilege via Parameter Tampering (STRIDE: Elevation of Privilege)
- **Vulnerability**: Attacker validates OTP for $15 item, then tampers checkout payload to purchase $2,000 electronics item.
- **Mitigation**: The OTP token is cryptographically bound to the specific `order_id` and `total_amount_cents` in Redis. Any change in cart contents invalidates the OTP.

---

### Invariants and Contracts

    Strict OTP Lifetime Invariant [INV-TM-01]
      Guest payment OTPs must expire within 600 seconds (10 minutes). Redis keys must have TTL <= 600.
      Requests evaluated after expiration are unconditionally rejected with HTTP 401.

    Attempt Limiting Invariant [INV-TM-02]
      A maximum of 3 failed code verification attempts is permitted per checkout token.
      Upon the 3rd failed attempt, the token must be permanently invalidated in Redis.

    Cart Value Binding Invariant [INV-TM-03]
      The authorization lease generated by OTP validation is immutably bound to the specific cart amount.
      If order total changes prior to authorization, the session requires fresh verification.

## Explicit Unknowns

- Third-party Twilio SMS delivery latency across international carrier aggregators (G-1).
- Effectiveness of Turnstile CAPTCHA against residential proxy bot farms in targeted fraud campaigns (G-2).

## Traceability

| Claim | Classification | Source | Freshness |
|---|---|---|---|
| Stored Stripe vault tokens | provided | Intake specification | Current |
| 24-hour OTP proposal rejection | decided | Sarah Chen & AppSec Review | 2026-09-15 |
| 10-minute OTP TTL, 3 attempts limit | decided | Architectural decision INV-TM-01 | 2026-09-15 |
| Ingress endpoints & delivery channels | provided | Intake specification | Current |
| STRIDE taxonomy application | derived | AppSec Threat Modeling Methodology | 2026-09-15 |


## Verification

No validator was supplied, so no command was run.

Reviewer self-check against threat model contracts:
- **STRIDE Coverage**: PASS. Threat scenarios evaluate Spoofing, Tampering, Info Disclosure, DoS, Elevation.
- **Mitigation Specificity**: PASS. Explicit 10-minute TTL, 3-attempt lockout, Turnstile CAPTCHA, cart binding.
- **Boundary Clarity**: PASS. Trust boundaries across external gateway, Redis, and Twilio/SendGrid mapped.

## Open Decisions

- `DEC-TM-01`: Sarah Chen to determine whether email OTP should be disabled entirely for guest orders exceeding $500 (Owner: Sarah Chen).

## Next steps

1. Alex Mercer and checkout team implement 10-minute Redis TTL and 3-attempt lockout in `guest_checkout_service`.
2. AppSec conducts penetration testing against the Turnstile CAPTCHA and rate-limiting endpoints.
3. Configure Datadog alerting for anomalous spikes in SMS OTP dispatch volume to detect toll fraud.