Threat model

A practical threat model for temporary secret handoffs.

This public threat model explains what Shhhs is designed to protect, what remains out of scope, and where metadata, support, billing, API, CLI, MCP, and Private Rooms boundaries apply.

01

Assets protected

Shhhs protects supported secret content, file payloads, request submissions, private-room messages, account tokens, API keys, passkeys, recovery codes, billing references, and operational metadata according to separate boundaries.

  • Secret payloads
  • Account access material
  • Operational metadata

02

Primary threats

The model focuses on link previews, accidental chat/email retention, recipient overexposure, API misuse, webhook leakage, admin/support metadata leakage, billing abuse, token theft, and automation logs.

  • Preview safety
  • Metadata-only operations
  • Scoped automation

03

Security controls

Controls include client-side encryption for supported payloads, URL-fragment key placement where applicable, TTL and view limits, burn/delete states, passkeys for paid accounts, scoped API keys, noindex private routes, Cloudflare security controls, and metadata-only audit events.

  • Client-side encryption for supported payloads
  • Private routes noindex
  • Scoped API keys

04

Explicit non-goals

Shhhs does not protect against compromised endpoints, malware, malicious browser extensions, screenshots, clipboard history, weak passphrases, recipient copying, social engineering, or sending every factor through the same compromised channel.

  • Compromised device out of scope
  • Recipient copy out of scope
  • Separate channels still matter

05

Review boundary

Changes to encryption, lifecycle, authorization, billing, API keys, admin access, webhooks, or private-route handling require tests and a security review note before release.

  • Regression tests
  • Security review note
  • No custom cryptography

FAQ

Does Shhhs process secrets with AI?

No. There is no AI processing on secret content.

Can Shhhs recover a secret?

No. Secret recovery would weaken the privacy model.

What can support recover?

Support can help cancel billing after billing validation, but cannot restore account access or secret content.