> ## Documentation Index
> Fetch the complete documentation index at: https://ihub.learnille.com/llms.txt
> Use this file to discover all available pages before exploring further.

# System Threat Model & OWASP Mitigation Matrix

> Migrated from the previous Learnille internal documentation hub

## Overview

This threat model identifies potential security threat vectors for Learnille and documents countermeasures implemented in the backend architecture and frontend clients.

***

## 🎯 Threat Analysis & Mitigations

| Threat Vector | Potential Impact | Countermeasure / Mitigation Strategy |
| :- | :- | :- |
| **SQL Injection (SQLi)** | Unauthorized data access or database destruction. | TypeORM parameterized queries & ORM abstraction. Explicit prohibition of raw concatenated SQL strings. |
| **Cross-Site Scripting (XSS)** | Session hijacking or DOM tampering. | React automatic DOM escaping, Content Security Policy (CSP) headers, sanitization of HTML inputs in comments. |
| **Broken Object-Level Auth (BOLA)** | Accessing another user's wallet or course progress. | NestJS `JwtAuthGuard` paired with explicit ownership validation (`userId === entity.ownerId` or CASL policies). |
| **Payment Webhook Forgery** | Fake course fulfillment without actual payment. | Strict signature verification of Paystack (`x-paystack-signature`) and Flutterwave HMAC header hashes before processing outbox events. |
| **Unauthorized Bank Payout** | Theft of provider wallet funds. | Multi-factor OTP verification required for new withdrawal methods and payout execution. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.