Security Review for Hone

Based on OWASP Top 10 (2021) and modern web security practices.

OWASP Top 10 Relevance to Hone

A01:2021 - Broken Access Control

• •Risk: Unauthorized access to other users' financial data
• •Hone Context: Currently single-user, but if multi-user is added:
  • •Implement proper session management
  • •Validate user owns requested resources
  • •Use principle of least privilege

A02:2021 - Cryptographic Failures

• •Data Classification: Transaction data is sensitive PII
• •At Rest: SQLCipher for database encryption (per DESIGN.md)
• •In Transit:
  • •All external connections MUST use TLS/HTTPS
  • •Ollama connection should use HTTPS if remote
• •Hashing: Using SHA-256 for deduplication (appropriate choice)

Database Encryption (Required):

// SQLCipher - open encrypted database
let conn = Connection::open("hone.db")?;
conn.pragma_update(None, "key", &passphrase)?;

// Key derivation - use Argon2 to derive key from user passphrase
use argon2::{Argon2, PasswordHasher};
let salt = SaltString::generate(&mut OsRng);
let argon2 = Argon2::default();
let key = argon2.hash_password(passphrase.as_bytes(), &salt)?;

Implementation Requirements:

• •Use rusqlite with bundled-sqlcipher feature
• •Derive encryption key from passphrase using Argon2
• •Passphrase provided at startup (env var or prompt)
• •Never log or expose the passphrase

Backup Encryption:

• •Backups encrypted with age before upload to Cloudflare R2
• •Consider post-quantum algorithms for future-proofing (harvest now, decrypt later threat)

A03:2021 - Injection

• •SQL Injection (Critical for hone-core/src/db.rs)
  • •All queries MUST use parameterized statements
  • •Never interpolate user input into SQL

// SECURE - parameterized query
conn.execute(
    "INSERT INTO transactions (account_id, amount) VALUES (?, ?)",
    params![account_id, amount]
)?;

// VULNERABLE - string interpolation
conn.execute(
    &format!("SELECT * FROM transactions WHERE merchant = '{}'", merchant),
    []
)?;

• •CSV Injection (hone-core/src/import.rs)
  • •Sanitize fields starting with =, +, -, @ (Excel formula injection)
  • •Validate numeric fields are actually numeric

A04:2021 - Insecure Design

• •Threat Modeling: Financial data attracts attackers
• •Defense in Depth: Multiple layers of validation
• •Secure Defaults: Restrictive CORS, minimal permissions

A05:2021 - Security Misconfiguration

• •CORS: Restrict to specific origins in production

// Development (permissive)
CorsLayer::permissive()

// Production (restrictive)
CorsLayer::new()
    .allow_origin("https://your-domain.com".parse::<HeaderValue>().unwrap())
    .allow_methods([Method::GET, Method::POST])

• •Error Messages: Never expose stack traces or internal paths
• •Headers: Set security headers (via tower-http)
  • •X-Content-Type-Options: nosniff
  • •X-Frame-Options: DENY
  • •Content-Security-Policy

A06:2021 - Vulnerable Components

• •Run cargo audit regularly (already set up)
• •Keep dependencies updated
• •Review transitive dependencies

A07:2021 - Authentication Failures

• •Currently N/A (single-user, local)
• •If adding auth:
  • •Use established libraries (not custom)
  • •Implement rate limiting
  • •Secure session management

A08:2021 - Data Integrity Failures

• •CSV Import: Validate file integrity
  • •Check file size limits
  • •Validate expected columns exist
  • •Reject malformed data gracefully

A09:2021 - Security Logging

• •Log security-relevant events:
  • •Failed authentication attempts (if added)
  • •Access to sensitive endpoints
  • •Import operations
• •Don't log sensitive data (transaction details, amounts)

A10:2021 - SSRF

• •Ollama Integration: Validate URL is localhost/trusted
• •Don't allow user-controlled URLs for HTTP requests

Frontend Security (React/TypeScript)

XSS Prevention

• •React escapes by default (good)
• •Never use dangerouslySetInnerHTML with user data
• •Sanitize data before rendering if from external source

Sensitive Data

• •Don't store financial data in localStorage/sessionStorage
• •Clear sensitive state on logout
• •Use httpOnly cookies for auth tokens (if added)

Content Security Policy

<meta http-equiv="Content-Security-Policy"
      content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'">

Secrets Management

Never Commit

• •API keys, tokens, passwords
• •Database credentials
• •Private keys

Secure Storage

• •Use .env files (gitignored)
• •Environment variables at runtime
• •Consider dotenv crate for Rust

Detection Patterns

# Patterns that indicate hardcoded secrets
api_key\s*[:=]
password\s*[:=]
secret\s*[:=]
token\s*[:=]
-----BEGIN.*PRIVATE KEY-----

Security Review Checklist

Database Layer (db.rs)

• • SQLCipher encryption enabled (bundled-sqlcipher feature)
• • Key derived via Argon2 from passphrase
• • All queries use parameterized statements (params![])
• • No string interpolation in SQL
• • Input validation before queries
• • Errors don't expose SQL details

Import Layer (import.rs)

• • File size limits enforced
• • Path traversal prevented
• • CSV fields sanitized
• • Malformed input handled gracefully

API Layer (hone-server)

• • Request validation on all endpoints
• • Generic error responses
• • CORS configured appropriately
• • Security headers set

Frontend (ui/)

• • No sensitive data in localStorage
• • XSS vectors checked
• • CSP headers configured
• • API errors handled gracefully

Resources

• •OWASP Top 10
• •OWASP Cheat Sheet Series
• •Rust Security Guidelines
• •React Security Best Practices