# Full-stack preview threat-model canvas

## Purpose and lifetime

- Source revision:
- Review audience:
- Created by:
- Expires at:
- Immediate revocation owner:

## Assets

- Source and build output:
- Preview data:
- Secret references:
- Identity/session state:
- Logs and release evidence:

## Boundaries

| Boundary | Allowed direction | Authentication | Policy | Evidence |
|---|---|---|---|---|
| User to preview | | | | |
| Build to artifact store | | | | |
| Preview to database | | | | |
| Preview to object storage | | | | |
| Preview to external network | | | | |

## Abuse cases

- Untrusted build reaches control-plane credentials:
- Preview reaches production data:
- Shared URL grants unintended access:
- Secret persists after expiry:
- Cleanup partially fails:

## Lifecycle proof

- [ ] Source/build identity recorded
- [ ] Preview bindings are non-production and least privilege
- [ ] Sharing policy tested
- [ ] Expiry and cleanup tested
- [ ] Promotion creates a separately verified production release