# Threat Model: Before You Sign

Status: draft for concept prototype. Revisit before any pilot.

## What we're protecting

- User’s private notes about suspicious contacts (receipts).
- Trust: the app must not look like a government product or imply official verification of people.

## Who might misuse it

| Threat | Who | Impact | Mitigation | Residual risk |
|---|---|---|---|---|
| Lost / stolen phone | Thief | Reads receipt notes | Notes stay local; advise short notes, no SSN/bank; user can delete | Device unlock still exposes notes |
| Shared family device | Partner / caregiver | Sees receipts | Clear delete controls; no account sync | Shared browsers can retain data |
| Look-alike clone | Scammer | Tricks user into trusting a fake “check” | Visible “Not affiliated…”, “registration only”, no seals/logos | Users may still skim |
| Misreading a mock hit as honesty | Any user | False confidence | Copy never says “real/fake/verified”; deep link to official search | Residual misunderstanding |
| Using .gov miss as “scam proof” | Any user | Wrong conclusion | “Checks registration only” + note that many real locals lack .gov | Residual misunderstanding |

## Abuse cases

The app cannot read messages, calls, or location. It cannot be used to monitor another person remotely. Receipts do not sync.

## OWASP MASVS groups that apply

STORAGE (localStorage only) · NETWORK (static HTTPS pages + user-opened links) · PRIVACY. No AUTH, no CRYPTO beyond HTTPS, no platform sensors.