Security — Lantern
Purpose
Security is a top priority for Lantern: protect users, merchant partners, and the mission. This document outlines the threat model, required controls, developer practices, incident response, and a compliance roadmap.
Core security principles
- Least privilege & defense in depth: limit access and use layered protections.
- Privacy by design: collect minimal PII and provide explicit consent flows for location-based features.
- Secure defaults: opt-in features disabled by default; strict deny-by-default rules for data access.
- Auditable & testable: logging, monitoring, and regular audits.
Threat model (high level)
Key assets:
- User location/check-in data
- PII and account credentials
- Merchant accounts and offer data
- Payment & billing information
- Admin credentials and deploy keys
- Service account keys and infrastructure
Primary threats:
- Data exfiltration (unauthorized access to Firestore / backups)
- Fraud (fake check-ins / redemptions)
- Compromise of admin or merchant accounts
- Supply-chain attacks via dependencies or compromised CI
- Account takeover and credential stuffing
Required technical controls (must-haves)
Authentication & Access
- Enforce MFA for all admin and merchant accounts.
- Use RBAC for internal services and admin consoles.
- Enforce strong password policies and SSO for employees when possible.
Network & Transport
- TLS everywhere (HTTPS). Do not permit unencrypted endpoints.
- Secure CORS and CSP policies in the frontend.
Data protection
- Encryption at rest for sensitive data; rotate keys regularly.
- Store minimal location data; hash or truncate precise values when possible.
- Use short retention windows for sensitive logs and location history.
Backend & verification
- Server-side verification for redemptions and payments (never trust client signals only).
- Use geofence + timestamp checks and optional QR verification for high-value redemptions.
- Implement rate limits and per-user/campaign caps.
Secrets & configuration
- Use Secret Manager (or cloud equivalent). Do not store secrets in repo or plaintext CI variables.
- Encrypted environment secrets for production only; restrict access via IAM.
CI/CD & supply chain
- Signed builds and pinned dependencies for production releases.
- Integrate dependency scanning (SCA), SAST, and container image scanning in CI.
- Restrict deployment keys and require code review for production changes.
Monitoring & logging
- Centralized logs with role-based access (do not include raw PII in logs).
- Alerting for anomalous patterns (sudden redemption spikes, repeated failed logins).
- Retain audit logs for an agreed period and rotate them securely.
Incident response & readiness
- Maintain an Incident Response (IR) playbook with on-call contacts and escalation paths.
- Prepare breach notification templates (users, merchants, regulators) and legal contact lists.
- Conduct table-top exercises at least twice a year and full penetration tests annually.
- Set up a vulnerability disclosure policy and consider a bug-bounty program after initial audits.
Compliance & assurance (roadmap)
- Short term: implement SAST/SCA, secret scanning, and access controls.
- Medium term: annual penetration tests and external security review.
- Longer term: SOC 2 Type II and/or ISO 27001 as prerequisites for enterprise integrations.
- Privacy: document processing activities, DPAs for vendors (e.g., Stripe), and support GDPR/CCPA rights.
Developer & operations practices
- Pre-merge checks: automated lint, unit tests, SAST, dependency checks.
- Secret scanning and blocked commits if secrets are detected.
- Periodic access reviews for IAM roles and service accounts.
- Onboarding checklist for developers: 2FA required, onboarding security training, access request process.
Backup & DR
- Regular backups of critical data with encrypted storage and tested restore procedures.
- RTO/RPO targets defined for critical services (e.g., Firestore, authentication) and periodic restore drills.
Quick security checklist (first 30 days)
- Enforce MFA for all admin/merchant accounts and enable SSO where possible.
- Add Secret Manager and remove secrets from repo and CI where found.
- Add SAST + SCA scans to CI and enable blocked merges on critical vulnerabilities.
- Configure audit logging and alerts for anomalous redemption patterns.
- Draft IR playbook and notification templates.
Final notes
Security is an ongoing practice. This document provides a baseline; as Lantern grows, adapt the roadmap, increase assurance levels (SOC 2 / ISO), and maintain transparency with your employee‑owners and merchant partners.
If you'd like, I can add a security/ folder with a starter IR playbook, alerting runbooks, and an incident template for immediate use.