Dangerzone Threat Model

Threats × Components

Component CAPEC-23 · File Content Injection Severity: Very High is sandboxed CAPEC-40 · Manipulating Writeable Terminal Devices Severity: Very High sanitizes input CAPEC-177 · Create files with the same name as files protected with a higher classification Severity: Very High assume not compromisedverifies resources.system CAPEC-480 · Escaping Virtualization Severity: Very High No mitigation exists for this threat. CAPEC-88 · OS Command Injection Severity: High is sandboxedsanitizes input CAPEC-186 · Malicious Software Update Severity: High verifies resources.updates CAPEC-440 · Hardware Integrity Attack Severity: High is verifiable CAPEC-444 · Development Alteration Severity: High is reviewed CAPEC-582 · Route Disabling Severity: High works offline CAPEC-28 · Fuzzing Severity: Medium sanitizes inputis fuzzed CAPEC-113 · Interface Manipulation Severity: Medium sanitizes inputis sandboxed CAPEC-130 · Excessive Allocation Severity: Medium is resource constrainedsanitizes input CAPEC-131 · Resource Leak Exposure Severity: Medium is resource constrained CAPEC-145 · Checksum Spoofing Severity: Medium uses strong crypto CAPEC-153 · Input Data Manipulation Severity: Medium is sandboxed CAPEC-165 · File Manipulation Severity: Medium is sandboxedsanitizes input CAPEC-176 · Configuration/Environment Manipulation Severity: Medium assume not compromisedverifies resources.system CAPEC-263 · Force Use of Corrupted Files Severity: Medium assume not compromisedverifies resources.system CAPEC-639 · Probe System Files Severity: Medium is sandboxed DZ-1-DEPS · Severity: Unknown verifies resources.deps DZ-1-UPD · Severity: Unknown verifies resources.updates DZ-2-CODE · Severity: Unknown is reviewed DZ-2-BUILD · Severity: Unknown is reproducibleis verifiable CAPEC-276 · Inter-component Protocol Manipulation Severity: Unknown is sandboxedsanitizes input CAPEC-439 · Manipulation During Distribution Severity: Unknown is verifiable CAPEC-473 · Signature Spoof Severity: Unknown uses strong crypto
Actor
User ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification User — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation User — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files User — mitigated assume not compromised verifies resources.system
dev ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification dev — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation dev — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files dev — mitigated assume not compromised verifies resources.system
Boundary
Dangerzone sandbox (VM + outer container + gVisor sandbox) ✗ CAPEC-177 · Create files with the same name as files protected with a higher classification Dangerzone sandbox (VM + outer container + gVisor sandbox) — not mitigated assume not compromisedverifies resources.system ✗ CAPEC-480 · Escaping Virtualization Dangerzone sandbox (VM + outer container + gVisor sandbox) — not mitigated No mitigation exists for this threat. ✗ CAPEC-176 · Configuration/Environment Manipulation Dangerzone sandbox (VM + outer container + gVisor sandbox) — not mitigated assume not compromisedverifies resources.system ✗ CAPEC-263 · Force Use of Corrupted Files Dangerzone sandbox (VM + outer container + gVisor sandbox) — not mitigated assume not compromisedverifies resources.system ✓ CAPEC-639 · Probe System Files Dangerzone sandbox (VM + outer container + gVisor sandbox) — mitigated is sandboxed
Docker/Podman VM ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Docker/Podman VM — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation Docker/Podman VM — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Docker/Podman VM — mitigated assume not compromised verifies resources.system
FPF-operated Tailnet ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification FPF-operated Tailnet — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation FPF-operated Tailnet — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files FPF-operated Tailnet — mitigated assume not compromised verifies resources.system
Internet ✗ CAPEC-582 · Route Disabling Internet — not mitigated works offline ✗ CAPEC-639 · Probe System Files Internet — not mitigated is sandboxed
Local host ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Local host — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation Local host — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Local host — mitigated assume not compromised verifies resources.system
Outer container ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Outer container — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation Outer container — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Outer container — mitigated assume not compromised verifies resources.system
gVisor sandbox ✗ CAPEC-177 · Create files with the same name as files protected with a higher classification gVisor sandbox — not mitigated assume not compromisedverifies resources.system ✗ CAPEC-480 · Escaping Virtualization gVisor sandbox — not mitigated No mitigation exists for this threat. ✗ CAPEC-176 · Configuration/Environment Manipulation gVisor sandbox — not mitigated assume not compromisedverifies resources.system ✗ CAPEC-263 · Force Use of Corrupted Files gVisor sandbox — not mitigated assume not compromisedverifies resources.system ✓ CAPEC-639 · Probe System Files gVisor sandbox — mitigated is sandboxed
Component
Certum Card ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Certum Card — mitigated assume not compromised verifies resources.system ✗ CAPEC-440 · Hardware Integrity Attack Certum Card — not mitigated is verifiable ✗ CAPEC-582 · Route Disabling Certum Card — not mitigated works offline ✓ CAPEC-176 · Configuration/Environment Manipulation Certum Card — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Certum Card — mitigated assume not compromised verifies resources.system
Container manager ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Container manager — mitigated assume not compromised verifies resources.system ✗ CAPEC-88 · OS Command Injection Container manager — not mitigated is sandboxedsanitizes input ✓ CAPEC-582 · Route Disabling Container manager — mitigated works offline ✓ CAPEC-145 · Checksum Spoofing Container manager — mitigated uses strong crypto ✓ CAPEC-176 · Configuration/Environment Manipulation Container manager — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Container manager — mitigated assume not compromised verifies resources.system ✓ DZ-2-BUILD · Container manager — mitigated is verifiable is reproducible ✗ CAPEC-276 · Inter-component Protocol Manipulation Container manager — not mitigated is sandboxedsanitizes input ✓ CAPEC-473 · Signature Spoof Container manager — mitigated uses strong crypto
Container runtime ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Container runtime — mitigated assume not compromised verifies resources.system ✓ CAPEC-88 · OS Command Injection Container runtime — mitigated is sandboxed sanitizes input ✓ CAPEC-582 · Route Disabling Container runtime — mitigated works offline ✓ CAPEC-145 · Checksum Spoofing Container runtime — mitigated uses strong crypto ✓ CAPEC-176 · Configuration/Environment Manipulation Container runtime — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Container runtime — mitigated assume not compromised verifies resources.system ✓ CAPEC-276 · Inter-component Protocol Manipulation Container runtime — mitigated is sandboxed sanitizes input ✓ CAPEC-473 · Signature Spoof Container runtime — mitigated uses strong crypto
Cosign Binary (build machines) ✗ CAPEC-23 · File Content Injection Cosign Binary (build machines) — not mitigated is sandboxed ✗ CAPEC-40 · Manipulating Writeable Terminal Devices Cosign Binary (build machines) — not mitigated sanitizes input ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Cosign Binary (build machines) — mitigated assume not compromised verifies resources.system ✗ CAPEC-582 · Route Disabling Cosign Binary (build machines) — not mitigated works offline ✗ CAPEC-28 · Fuzzing Cosign Binary (build machines) — not mitigated sanitizes inputis fuzzed ✗ CAPEC-113 · Interface Manipulation Cosign Binary (build machines) — not mitigated sanitizes inputis sandboxed ✗ CAPEC-130 · Excessive Allocation Cosign Binary (build machines) — not mitigated is resource constrainedsanitizes input ✗ CAPEC-131 · Resource Leak Exposure Cosign Binary (build machines) — not mitigated is resource constrained ✓ CAPEC-145 · Checksum Spoofing Cosign Binary (build machines) — mitigated uses strong crypto ✗ CAPEC-165 · File Manipulation Cosign Binary (build machines) — not mitigated is sandboxedsanitizes input ✓ CAPEC-176 · Configuration/Environment Manipulation Cosign Binary (build machines) — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Cosign Binary (build machines) — mitigated assume not compromised verifies resources.system ✗ CAPEC-639 · Probe System Files Cosign Binary (build machines) — not mitigated is sandboxed ✗ CAPEC-276 · Inter-component Protocol Manipulation Cosign Binary (build machines) — not mitigated is sandboxedsanitizes input ✓ CAPEC-473 · Signature Spoof Cosign Binary (build machines) — mitigated uses strong crypto
Cosign Binary (embedded) ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Cosign Binary (embedded) — mitigated assume not compromised verifies resources.system ✓ CAPEC-582 · Route Disabling Cosign Binary (embedded) — mitigated works offline ✓ CAPEC-145 · Checksum Spoofing Cosign Binary (embedded) — mitigated uses strong crypto ✓ CAPEC-176 · Configuration/Environment Manipulation Cosign Binary (embedded) — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Cosign Binary (embedded) — mitigated assume not compromised verifies resources.system ✓ DZ-2-BUILD · Cosign Binary (embedded) — mitigated is verifiable is reproducible ✓ CAPEC-473 · Signature Spoof Cosign Binary (embedded) — mitigated uses strong crypto
DZ App ✗ CAPEC-23 · File Content Injection DZ App — not mitigated is sandboxed ✓ CAPEC-40 · Manipulating Writeable Terminal Devices DZ App — mitigated sanitizes input ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification DZ App — mitigated assume not compromised verifies resources.system ✓ CAPEC-88 · OS Command Injection DZ App — mitigated sanitizes input is sandboxed ✗ CAPEC-186 · Malicious Software Update DZ App — not mitigated verifies resources.updates ✗ CAPEC-444 · Development Alteration DZ App — not mitigated is reviewed ✓ CAPEC-582 · Route Disabling DZ App — mitigated works offline ✓ CAPEC-28 · Fuzzing DZ App — mitigated sanitizes input is fuzzed ✓ CAPEC-113 · Interface Manipulation DZ App — mitigated sanitizes input is sandboxed ✓ CAPEC-130 · Excessive Allocation DZ App — mitigated sanitizes input is resource constrained ✗ CAPEC-131 · Resource Leak Exposure DZ App — not mitigated is resource constrained ✓ CAPEC-145 · Checksum Spoofing DZ App — mitigated uses strong crypto ✗ CAPEC-153 · Input Data Manipulation DZ App — not mitigated is sandboxed ✓ CAPEC-165 · File Manipulation DZ App — mitigated sanitizes input is sandboxed ✓ CAPEC-176 · Configuration/Environment Manipulation DZ App — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files DZ App — mitigated assume not compromised verifies resources.system ✗ CAPEC-639 · Probe System Files DZ App — not mitigated is sandboxed ✗ DZ-1-UPD · DZ App — not mitigated verifies resources.updates ✗ DZ-2-CODE · DZ App — not mitigated is reviewed ✗ DZ-2-BUILD · DZ App — not mitigated is reproducibleis verifiable ✓ CAPEC-276 · Inter-component Protocol Manipulation DZ App — mitigated sanitizes input is sandboxed ✓ CAPEC-473 · Signature Spoof DZ App — mitigated uses strong crypto
LibreOffice ✓ CAPEC-23 · File Content Injection LibreOffice — mitigated is sandboxed ✗ CAPEC-40 · Manipulating Writeable Terminal Devices LibreOffice — not mitigated sanitizes input ✗ CAPEC-177 · Create files with the same name as files protected with a higher classification LibreOffice — not mitigated assume not compromisedverifies resources.system ✗ CAPEC-480 · Escaping Virtualization LibreOffice — not mitigated No mitigation exists for this threat. ✗ CAPEC-28 · Fuzzing LibreOffice — not mitigated sanitizes inputis fuzzed ✓ CAPEC-113 · Interface Manipulation LibreOffice — mitigated is sandboxed sanitizes input ✗ CAPEC-130 · Excessive Allocation LibreOffice — not mitigated is resource constrainedsanitizes input ✗ CAPEC-131 · Resource Leak Exposure LibreOffice — not mitigated is resource constrained ✓ CAPEC-165 · File Manipulation LibreOffice — mitigated is sandboxed sanitizes input ✗ CAPEC-176 · Configuration/Environment Manipulation LibreOffice — not mitigated assume not compromisedverifies resources.system ✗ CAPEC-263 · Force Use of Corrupted Files LibreOffice — not mitigated assume not compromisedverifies resources.system ✓ CAPEC-639 · Probe System Files LibreOffice — mitigated is sandboxed ✓ CAPEC-276 · Inter-component Protocol Manipulation LibreOffice — mitigated is sandboxed sanitizes input
PDF reader ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification PDF reader — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation PDF reader — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files PDF reader — mitigated assume not compromised verifies resources.system
YubiKey ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification YubiKey — mitigated assume not compromised verifies resources.system ✗ CAPEC-440 · Hardware Integrity Attack YubiKey — not mitigated is verifiable ✓ CAPEC-176 · Configuration/Environment Manipulation YubiKey — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files YubiKey — mitigated assume not compromised verifies resources.system
doc_to_pixels.py ✓ CAPEC-23 · File Content Injection doc_to_pixels.py — mitigated is sandboxed ✓ CAPEC-40 · Manipulating Writeable Terminal Devices doc_to_pixels.py — mitigated sanitizes input ✗ CAPEC-177 · Create files with the same name as files protected with a higher classification doc_to_pixels.py — not mitigated assume not compromisedverifies resources.system ✗ CAPEC-480 · Escaping Virtualization doc_to_pixels.py — not mitigated No mitigation exists for this threat. ✓ CAPEC-88 · OS Command Injection doc_to_pixels.py — mitigated is sandboxedsanitizes input ✓ CAPEC-28 · Fuzzing doc_to_pixels.py — mitigated sanitizes input is fuzzed ✓ CAPEC-113 · Interface Manipulation doc_to_pixels.py — mitigated sanitizes inputis sandboxed ✓ CAPEC-130 · Excessive Allocation doc_to_pixels.py — mitigated sanitizes input is resource constrained ✗ CAPEC-131 · Resource Leak Exposure doc_to_pixels.py — not mitigated is resource constrained ✓ CAPEC-153 · Input Data Manipulation doc_to_pixels.py — mitigated is sandboxed ✓ CAPEC-165 · File Manipulation doc_to_pixels.py — mitigated is sandboxedsanitizes input ✗ CAPEC-176 · Configuration/Environment Manipulation doc_to_pixels.py — not mitigated assume not compromisedverifies resources.system ✗ CAPEC-263 · Force Use of Corrupted Files doc_to_pixels.py — not mitigated assume not compromisedverifies resources.system ✓ CAPEC-639 · Probe System Files doc_to_pixels.py — mitigated is sandboxed ✓ CAPEC-276 · Inter-component Protocol Manipulation doc_to_pixels.py — mitigated is sandboxedsanitizes input
entrypoint.py ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification entrypoint.py — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation entrypoint.py — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files entrypoint.py — mitigated assume not compromised verifies resources.system
Data
DZ container image ✗ CAPEC-639 · Probe System Files DZ container image — not mitigated is sandboxed ✓ DZ-2-BUILD · DZ container image — mitigated is reproducibleis verifiable
DZ release binary ✗ CAPEC-639 · Probe System Files DZ release binary — not mitigated is sandboxed ✓ DZ-2-BUILD · DZ release binary — mitigated is verifiable is reproducible
Embedded Log Index ✗ CAPEC-639 · Probe System Files Embedded Log Index — not mitigated is sandboxed ✓ DZ-2-BUILD · Embedded Log Index — mitigated is verifiable is reproducible
Embedded Sandbox ✗ CAPEC-639 · Probe System Files Embedded Sandbox — not mitigated is sandboxed ✓ DZ-2-BUILD · Embedded Sandbox — mitigated is reproducibleis verifiable
Pixels (rasterized document) ✗ CAPEC-639 · Probe System Files Pixels (rasterized document) — not mitigated is sandboxed
Release Changelog ✗ CAPEC-639 · Probe System Files Release Changelog — not mitigated is sandboxed ✗ DZ-2-BUILD · Release Changelog — not mitigated is reproducibleis verifiable
Release Private Key ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Release Private Key — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation Release Private Key — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Release Private Key — mitigated assume not compromised verifies resources.system
Release Public Key ✗ CAPEC-639 · Probe System Files Release Public Key — not mitigated is sandboxed ✓ DZ-2-BUILD · Release Public Key — mitigated is verifiable is reproducible
Release Signature Data ✗ CAPEC-639 · Probe System Files Release Signature Data — not mitigated is sandboxed ✓ DZ-2-BUILD · Release Signature Data — mitigated is verifiable is reproducible
Release reference ✗ CAPEC-639 · Probe System Files Release reference — not mitigated is sandboxed
Remote Log Index ✗ CAPEC-639 · Probe System Files Remote Log Index — not mitigated is sandboxed ✓ DZ-2-BUILD · Remote Log Index — mitigated is verifiable is reproducible
Remote Sandbox Image ✗ CAPEC-582 · Route Disabling Remote Sandbox Image — not mitigated works offline ✗ CAPEC-639 · Probe System Files Remote Sandbox Image — not mitigated is sandboxed ✓ DZ-2-BUILD · Remote Sandbox Image — mitigated is reproducibleis verifiable
Sandbox Private Key ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Sandbox Private Key — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation Sandbox Private Key — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Sandbox Private Key — mitigated assume not compromised verifies resources.system
Sandbox Public Key ✗ CAPEC-639 · Probe System Files Sandbox Public Key — not mitigated is sandboxed ✓ DZ-2-BUILD · Sandbox Public Key — mitigated is verifiable is reproducible
Sandbox Signature Data ✗ CAPEC-639 · Probe System Files Sandbox Signature Data — not mitigated is sandboxed ✓ DZ-2-BUILD · Sandbox Signature Data — mitigated is verifiable is reproducible
Suspicious doc ✗ CAPEC-639 · Probe System Files Suspicious doc — not mitigated is sandboxed
Datastore
Host storage ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Host storage — mitigated assume not compromised verifies resources.system ✓ CAPEC-176 · Configuration/Environment Manipulation Host storage — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Host storage — mitigated assume not compromised verifies resources.system
ExternalEntity
DZ GitHub repo ✗ CAPEC-582 · Route Disabling DZ GitHub repo — not mitigated works offline ✗ CAPEC-639 · Probe System Files DZ GitHub repo — not mitigated is sandboxed ✓ CAPEC-439 · Manipulation During Distribution DZ GitHub repo — mitigated is verifiable
External github repositories ✗ CAPEC-582 · Route Disabling External github repositories — not mitigated works offline ✗ CAPEC-639 · Probe System Files External github repositories — not mitigated is sandboxed ✗ CAPEC-439 · Manipulation During Distribution External github repositories — not mitigated is verifiable
GitHub Container Registry ✗ CAPEC-582 · Route Disabling GitHub Container Registry — not mitigated works offline ✗ CAPEC-639 · Probe System Files GitHub Container Registry — not mitigated is sandboxed ✓ CAPEC-439 · Manipulation During Distribution GitHub Container Registry — mitigated is verifiable
GitHub release server ✗ CAPEC-582 · Route Disabling GitHub release server — not mitigated works offline ✗ CAPEC-639 · Probe System Files GitHub release server — not mitigated is sandboxed ✗ CAPEC-439 · Manipulation During Distribution GitHub release server — not mitigated is verifiable
Random doc source ✗ CAPEC-582 · Route Disabling Random doc source — not mitigated works offline ✗ CAPEC-639 · Probe System Files Random doc source — not mitigated is sandboxed
Rekor Log Server ✗ CAPEC-582 · Route Disabling Rekor Log Server — not mitigated works offline ✗ CAPEC-639 · Probe System Files Rekor Log Server — not mitigated is sandboxed
Server
Build machines ✓ CAPEC-177 · Create files with the same name as files protected with a higher classification Build machines — mitigated assume not compromised verifies resources.system ✓ CAPEC-186 · Malicious Software Update Build machines — mitigated verifies resources.updates ✗ CAPEC-440 · Hardware Integrity Attack Build machines — not mitigated is verifiable ✗ CAPEC-582 · Route Disabling Build machines — not mitigated works offline ✗ CAPEC-145 · Checksum Spoofing Build machines — not mitigated uses strong crypto ✓ CAPEC-176 · Configuration/Environment Manipulation Build machines — mitigated assume not compromised verifies resources.system ✓ CAPEC-263 · Force Use of Corrupted Files Build machines — mitigated assume not compromised verifies resources.system ✗ DZ-1-DEPS · Build machines — not mitigated verifies resources.deps ✓ DZ-1-UPD · Build machines — mitigated verifies resources.updates ✗ CAPEC-473 · Signature Spoof Build machines — not mitigated uses strong crypto
DZ Linux package server ✗ CAPEC-582 · Route Disabling DZ Linux package server — not mitigated works offline ✗ CAPEC-639 · Probe System Files DZ Linux package server — not mitigated is sandboxed ✓ CAPEC-439 · Manipulation During Distribution DZ Linux package server — mitigated is verifiable
dangerzone.rocks ✗ CAPEC-582 · Route Disabling dangerzone.rocks — not mitigated works offline ✗ CAPEC-639 · Probe System Files dangerzone.rocks — not mitigated is sandboxed ✗ CAPEC-439 · Manipulation During Distribution dangerzone.rocks — not mitigated is verifiable