Security (Operations Digest)

Quick summary

Three parties have different responsibilities: DevPay operates its authority, sellers operate their servers, and buyers control their devices.

Use the feature-flag and fail-closed checklist before enabling a security mode. Residual client and BYOS risks remain.

Condensed operational read of docs/product/trust-model.md — that file and the experiment threat models are normative.

The three-party split

• DevPay — license + entitlement authority; meters only hosted calls; SLA covers authority availability + its own D1 records, not seller servers or buyer devices.
• Seller — owns software, feature namespace, BYOS enforcement server, server-side paid-feature correctness, refunds as customer-facing action.
• Buyer — license key + device keypair inside an attacker-controlled environment.

Fail-closed rules the code enforces

• Missing row / DB error → denial, never permission (auth, tenant scope, entitlement gates, store adapters all follow this).
• Seller scope re-checked in DB per request (seller_scope_db, seller_memberships) — not trusted from the JWT claim.
• Public endpoints never receive credentials — only public_id may be embedded in visitor-facing code.
• Token invalidation is DB-backed: token_version bump on logout/deactivate/password change kills all prior tokens.
• Webhook bodies are never trusted — Toss webhook is signature-verified, ref-validated, then PG state is refetched.
• security_events records denials without keys/tokens/PII.

Feature flags that matter

Flag	Risk if wrong
LICENSE_SECURITY_ENABLED	PoP plane exposed or silently absent — currently absent (404), so all PoP evidence is loopback
PAYMENT_LIVE_ENABLED	must stay false until a real-PG decision + credentials exist
PAYMENT_PROVIDER	mock/toss only; portone → 503
DEV_AUTH / ALLOW_ACT_AS_SELLER	dev escapes — must never reach production
CORS_ALLOWED_ORIGINS	explicit list in staging; * is not acceptable in prod

Residual risks to operate around

• Seller can remove client-side checks in their own product (structural).
• Buyer-side analog hole / cooperative relay — metered, not prevented.
• node:vm/threads are not a sandbox boundary — the protect pipeline must never run beside caller-forbidden secrets.
• Key rotation is a hard cutover — in-flight entitlements die (bounded by 120 s TTL); coordinate rotations.
• Rate limiting only on /auth/login; public licenses/verify is unthrottled at app layer and seller-issued NG-… keys are 32-bit enumerable — treat verify as an oracle and monitor it.

Independent security verification of the candidate SHAs lives in docs/security/product-red-team.md and the agent release-gate records — those are evidence artifacts, and this page does not relabel them.