Security & Trust by Design
BurnBox enables intelligence analysts, security researchers, and fraud investigators to probe untrusted web targets without compromising internal networks or exposing operational infrastructure.
Pre-flight DNS & SSRF Shield
To prevent Server-Side Request Forgery when investigating untrusted URLs, BurnBox performs authoritative pre-flight DNS resolution before dispatching crawl jobs. Requests targeting private RFC1918 networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopbacks (127.0.0.0/8, ::1), link-local addresses, and cloud provider metadata services (169.254.169.254) are rejected immediately. HTTP redirects are inspected recursively.
Multi-Tenant Isolation & Server-Enforced RBAC
Tenant organizational boundaries are validated strictly on the server for every API route using Clerk session context and Appwrite TablesDB tenant scoping. Client-provided tenant identifiers in headers or request bodies are never trusted blindly. Cross-tenant reads, modifications, and exports fail closed with HTTP 403 Forbidden.
Decoupled Crawler Architecture
Web investigations run through a dedicated WebCrawlerProvider abstraction backed by Scrapy Cloud workers. BurnBox control plane nodes never directly fetch or execute untrusted web payloads, eliminating local exploit surface while maintaining high throughput and structured evidence harvesting.
Tamper-Evident Immutable Audit Logging
Every investigation launched, project created, evidence item collected, and security block encountered emits an immutable audit event with a correlation ID, timestamp, and actor identity. Audit records provide non-repudiation for security compliance and incident investigations.
Threat Model & Mitigations
| THREAT VECTOR | POTENTIAL IMPACT | BURNBOX MITIGATION |
|---|---|---|
| SSRF via Target URL | Access to internal control plane, metadata, or cloud credentials | Pre-flight DNS check, private CIDR block, recursive redirect validation |
| Cross-Tenant Data Exposure | Unauthorized access to other teams' research and evidence | Server-side Clerk session extraction, Appwrite tenant-filtered queries |
| Malicious Web Payloads | Host exploitation during target page harvesting | Decoupled Scrapy Cloud spider execution; zero untrusted code run on control plane |
| Unauthorized Action Repudiation | Disputed audit events or unaccounted investigation runs | Structured immutable audit logging with actor attribution and correlation IDs |