Scope: src/hooks.server.ts, src/hooks.client.ts, src/hooks.ws.ts, the system/test/audit/header hooks, the root layouts, src/routes/setup/**, src/routes/email-previews/**, the machine-readable endpoints (robots.txt, sitemap*.xml, llms.txt, indexnow.txt), the system/testing handlers and src/utils/test-bypass.server.ts.

STRIDE

Threat	Surface	Existing control (file reference)	Residual risk
Spoofing — test bypass is used in production	src/utils/test-bypass.server.ts	The bypass requires the test mode flag and a timing-safe comparison of x-test-secret against the configured secret; environment reads are runtime, not module-load.	A production deployment that sets the test flag and a known secret is misconfigured; the build stripper is the second layer.
Tampering — test handlers ship in a production bundle	scripts/security/verify-prod-build-backdoor.ts	The build plugin replaces the testing handler with a 404 stub unless COMPILE_ALL_ADAPTERS=true; the verify script checks both deploy and bench modes.	The verify script must run in CI after every build; a skipped step removes the guarantee.
Repudiation — privileged operations lack an audit trail	src/hooks/handle-audit-logging.ts	Audit writes include actor, route and outcome for authenticated mutations.	Log retention and shipping are deployment concerns outside this repository.
Information disclosure — responses miss hardening headers	src/hooks/handle-security-headers.ts	CSP, HSTS, X-Frame-Options: DENY and related headers are applied in the global pipeline.	Self-hosted deployments that terminate TLS can strip HSTS before the client sees it.
Denial of service — requests during initialization or recovery	src/hooks/handle-system-state.ts	The state gate blocks or queues requests until the system leaves INITIALIZING/RECOVERY, with a documented bypass for a stuck state.	The stuck-state bypass trades availability for correctness; operators must watch the state logs.
Elevation of privilege — setup can be re-run after completion	src/routes/api/[...path]/handlers/setup.ts	Setup handlers call isSetupCompleteAsync()/isSetupComplete() and reject with SETUP_ALREADY_COMPLETE; the setup pages redirect once configured.	A fresh database with a stale config file is an operational edge that the check cannot distinguish.
Tampering — open redirect via the redirect hook	src/hooks/handle-redirects.ts	Redirect targets are resolved through the shared safe-redirect validation before a 3xx response is returned.	Redirect rules authored by administrators can still point at external hosts if the rule syntax allows it.

Assumptions

• src/hooks.server.ts is the only pipeline composition; adding a hook requires updating this surface and its fingerprint.
• Test-only handlers are unreachable in production because the handler is stripped at build time, not merely because of a runtime flag.
• Machine endpoints (robots.txt, sitemaps) are public by design and expose only routes the site already publishes.