Security at OCA

Threat model

The Service protects against: test-set leakage; receipt forgery; billing fraud; cross-tenant leakage; bank-account takeover.

Encryption

• In transit — TLS 1.3 only. HSTS at the edge.
• At rest — Cloudflare-managed AES-256 on KV, R2, and Durable Objects.
• Receipts — HMAC-SHA256 over canonical-JSON payload, keyed by RECEIPT_SECRET. Immutable.

Authentication

• Customers — license key = customer_id|hmac_sha256(customer_id, LICENSE_SECRET). Verified timing-safely.
• Admin — separate ADMIN_TOKEN bearer, timing-safe compared, never logged.
• Plaid webhook — HMAC-SHA256 verified against PLAID_WEBHOOK_SECRET. Invalid → 400 + discard.
• Operator — MFA on Cloudflare, GitHub, Plaid accounts. OAuth tokens scoped to workers:write, pages:write, etc.

Held-out data isolation

Module challenges, ground truths, and reference scorers live only in the Worker source bundle. A pre-deploy test asserts that no _groundTruth or _secret key leaks into any customer-facing payload. Customer responses are scored in Worker memory and released; never persisted.

Network

• No SSH, no console, no exposed management port. Only 443.
• Cloudflare WAF and DDoS protection in front of every route.
• CORS locked to oca-web.pages.dev in production (currently * for development; toggle via ALLOWED_ORIGINS secret).

Audit & monitoring

• Every wrangler deploy and wrangler secret put is recorded with operator identity.
• Worker logs include request metadata only — never Authorization, license, bank, or Plaid credentials.
• Receipts are INSERT OR IGNORE: once written, never updated.

Secrets

• Set only via wrangler secret put. Stored in the Cloudflare secret store.
• Never written to wrangler.jsonc, never committed to git (the .gitignore excludes .secrets.json and .plaid-secrets.json), never logged.
• Rotation procedure: wrangler secret put KEY then wrangler deploy.

Incident response

If a secret is suspected compromised: rotate → redeploy → notify customers via the email on file (in the INVOICES KV). Security issues: carelessapparelllc@gmail.com; acknowledged within 48 hours.

Reporting a vulnerability

Email carelessapparelllc@gmail.com with a description and reproduction steps. Coordinated disclosure; we will not pursue legal action against good-faith researchers.