| Threat | Implemented boundary | Remaining work |
|---|---|---|
| Duplicate/replayed writes | Actor-scoped idempotency key + canonical fingerprint, transactional stored response | Retention policy for idempotency keys |
| Concurrent stock double spending | SQLite immediate write transactions; PostgreSQL balance locks; nonnegative/reservation DB checks | Load testing on PostgreSQL, deadlock retries with same key |
| Silent stock/audit edits | Database triggers reject update/delete; correction is a new event | Separate DB roles, external immutable backups, tamper-evident export |
| Cross-location access | Server-side session user activation, role checks, scoped reads/writes | Real multi-company provisioning and PostgreSQL load testing remain outside this synthetic demo |
| Forged approvals | Owner/manager checks per endpoint, independent transfer/order state machine | MFA, managed identity, approval policy configuration and separation of duties |
| Session theft / CSRF | HttpOnly strict cookies, 8-hour server sessions (at most 5 per user; expired sessions purged at sign-in), CSRF token, origin checks; Secure cookie and HSTS on HTTPS or with SESSION_SECURE=true; Permissions-Policy and cross-origin isolation headers |
HTTPS termination, MFA, password reset, session/device management UI |
| Password guessing | scrypt at OWASP cost (N=2^17, r=8, p=1) with parameters stored per hash and upgraded at sign-in; unknown emails spend the same hashing time; per-IP limit plus per-account lockout after 10 failures in 15 minutes; failed attempts audited with a hashed email | Lockout can be triggered deliberately against a known account; CAPTCHA/step-up, breached-password checks, distributed rate limiter |
| Default credentials | Seeding with POLEA_DEMO=false refuses the public demo password or one under 12 characters |
Per-user invitations and forced first-login password change |
| Malicious uploads | Authenticated image-only endpoints, MIME/size/pixel/decode limits, image re-encoding, hash filenames, authorized image reads | Malware scanning, original-file quarantine, encrypted object store, retention/deletion policy |
| Erroneous OCR | Explicit local/fixture adapter label, unresolved ambiguities, side-by-side original image, required confirmations, atomic count adjustments, version check | Provenance at word coordinates, independent count observation timestamps |
| Duplicate ledger photos | Raw-byte SHA-256 and unique date/location/product/lot count fingerprint | Near-duplicate image similarity, controlled correction workflow for repeat counts |
| Text/prompt injection | No generative agent executes document text; deterministic parsing and typed server validation | Additional parser fuzzing and production document isolation |
| Expired/recalled supply | Lot eligibility checked for sales and dispatch; FEFO excludes restricted stock | Recall management, quarantine receiving review, regulatory traceability |
| False certainty | Seed/simulation labels, measured backtests, distribution assumptions, soft service target disclosure | Calibrated intervals, empirical lead times, dependence/seasonality risk models |
| Process/queue failure | Atomic stock and outbox commit; durable inbox dedup; expiring worker leases, five retries, owner-visible failed-job retries | Monitoring/alerting, distributed rate limiter, operational backup/restore drills |
No patient data, therapeutic substitutions, controlled substances, or regulated dispensing workflows. A legal/regulatory review and validated operations are required before live deployment. This document is an engineering gap inventory, not a claim of compliance.
Reviewer isolation: default DEMO_ISOLATION=true creates a separate synthetic SQLite database/PostgreSQL schema selected through a random HttpOnly cookie. Sessions do not work without the matching workspace. Registry tokens are stored hashed and expire after 24 hours; expiry denies access but does not physically erase files. Host operators must define retention/cleanup before public long-term hosting. Optional DEMO_ACCESS_CODE, provisioning rate/capacity limits, scoped images and independent user session tokens reduce accidental sharing. Public role passwords are intentionally available for this YC demo; never reuse them for real operations.
Telegram authorization uses numeric identity mapped by a single-use hashed five-minute code. Private chats only; usernames never confer permissions. Webhooks require a 24+ character secret header, updates are durable/deduplicated, and write callbacks are bound to one user with a 15-minute expiry. Execution rechecks activation/role/branches and uses stock idempotency. Revoking access cancels drafts and sessions. Secrets are environment-only; transport errors do not log token-bearing URLs. A forged simulator actor ID cannot replace the authenticated user. Live Telegram delivery and the PostgreSQL path require deployment verification.