Threat Model
Relevant source files
The following files were used as context for generating this wiki page:
The e-zer0 threat model identifies and mitigates security risks associated with bridging AI agents to sensitive email accounts. It prioritizes the protection of PII (Personally Identifiable Information), prevents prompt injection attacks, and ensures secure credential management within a self-hosted Cloudflare environment.
The system assumes a Zero Trust Architecture where agents authenticate via short-lived JWTs and all operations undergo strict auditing. By running entirely on the user's Cloudflare infrastructure, the project eliminates third-party exposure of raw credentials.
Sources: README.md:12-16, README.md:38-40
Core Security Architecture
The architecture relies on the Cloudflare Developer Platform to isolate compute and storage. It utilizes Web Crypto APIs for cryptographic operations and D1 for encrypted data persistence.
This diagram illustrates the data flow and isolation boundaries within the Cloudflare environment.
Sources: AGENTS.md:15-21, README.md:38-43
Identified Threats and Mitigations
The following table summarizes the primary threats handled by the e-zer0 security layer.
| Threat Category | Description | Mitigation Strategy |
|---|---|---|
| Prompt Injection | Malicious emails containing instructions to hijack AI agents. | Pattern-based scanning and risk scoring in sanitizer.ts. |
| PII Leakage | Exposure of sensitive data (credit cards, SSNs) to LLM providers. | Automatic regex-based redaction before content reaches the agent. |
| Credential Theft | Unauthorized access to OAuth tokens or API keys. | AES-256-GCM encryption at rest; secrets stored in D1 vault. |
| Brute Force / DoS | Excessive requests exhausting Worker budgets or attacking login. | Cloudflare Turnstile and KV-based rate limiting. |
| Unauthorized Action | AI agents performing destructive actions without oversight. | Full audit logging of every tool execution and specific agent grants. |
Sources: README.md:28-36, src/lib/sanitizer.ts:3-120, src/app.ts:41-45
Prompt Injection Protection
The sanitizeEmailContent function scans email text for high-risk patterns such as "ignore previous instructions" or "system:". It assigns a risk score from 0 to 100. If the score meets or exceeds 50, the system prepends a SAFETY WARNING to the content.
Sources: src/lib/sanitizer.ts:167-210, README.md:29-31
PII Redaction
The system uses a set of PII_PATTERNS to identify and replace sensitive data with redacted placeholders (e.g., [CREDIT_CARD_REDACTED]). This occurs in the Worker before the agent receives the tool response.
Sources: src/lib/sanitizer.ts:6-66, AGENTS.md:73-75
Data Flow Security
The system ensures that sensitive data is only decrypted immediately before use and never logged in plain text.
This sequence shows the lifecycle of a request, highlighting the decryption and sanitization checkpoints.
Sources: src/mcp/tools.ts:108-144, src/mcp/tools.ts:50-75
Cryptographic Standards
e-zer0 strictly adheres to modern cryptographic standards using the Web Crypto API (crypto.subtle).
- Encryption at Rest: AES-256-GCM is used for email provider tokens and application settings.
- Password Hashing: PBKDF2 is utilized for administrator credentials.
- Secret Generation:
setup-cf.jsgenerates 64-character hexadecimal strings forENCRYPTION_KEYandJWT_SECRET. - Identity: OAuth credentials (Client ID/Secret) are encrypted before storage in the
app_settingstable.
Sources: AGENTS.md:52-54, README.md:33-35, scripts/setup-cf.js:23-50
Defensive Middleware
The Hono application implementation includes multiple layers of defensive middleware to protect the web UI and API endpoints.
- Security Headers:
secureHeaders()is applied globally to prevent common web attacks. - CSRF Protection: Mutation routes (settings, agents, accounts) are protected by CSRF tokens.
- Startup Guard: The application terminates with a 503 error if the
RATE_LIMITERKV binding is missing, preventing unprotected execution. - Bot Protection: Cloudflare Turnstile is enforced on login and setup pages to prevent automated account attacks.
Sources: src/app.ts:34-58, README.md:121-124
Summary
The e-zer0 threat model establishes a "Safety-First" bridge for AI agents. By combining automated content sanitization, zero-knowledge credential storage (via user-owned keys), and mandatory audit trails, it mitigates the risks of both external attackers (via prompt injection) and infrastructure providers (via self-hosting and PII redaction).
Sources: README.md:27-36, AGENTS.md:68-76