This document identifies the assets protected by the Hex ecosystem.
For where these assets are stored and how they flow through the system, see Architecture. For threats targeting these assets, see Threats.
Package tarballs containing source code distributed to consumers.
| Attribute | Description |
|---|---|
| Location | S3 storage, served via CDN |
| Impact if compromised | Arbitrary code execution in downstream systems |
| Protection | Checksums, signed registry, immutable versions (after one hour, or 24 hours for newly created packages) |
Signed protobuf files containing package versions, dependencies, and checksums.
| Attribute | Description |
|---|---|
| Location | S3 storage (protobuf files), served via CDN |
| Impact if compromised | Dependency confusion, version manipulation |
| Protection | RSA-PKCS1-SHA512 signatures, repository field verification |
Private RSA key used to sign all registry files.
| Attribute | Description |
|---|---|
| Location | Secrets management |
| Impact if compromised | Attacker could sign malicious registry, bypassing all client verification |
| Protection | Access control, rotation procedures |
User credentials and authentication state.
| Attribute | Description |
|---|---|
| Location | Database (hashed passwords, TOTP secrets) |
| Impact if compromised | Unauthorized package publishing |
| Protection | Strong passwords, 2FA, OAuth tokens |
Bearer tokens for API access.
| Attribute | Description |
|---|---|
| Location | Database (hashed), client machines (plaintext/encrypted) |
| Impact if compromised | Unauthorized actions within token scope |
| Protection | Scoping, revocation, short-lived OAuth tokens |
User-generated HTML documentation.
| Attribute | Description |
|---|---|
| Location | S3 storage, served via hexdocs.pm |
| Impact if compromised | XSS attacks, phishing |
| Protection | CSP headers, per-package origin isolation (<package>.hexdocs.pm, <org>.hexorgs.pm/<package>) |
Namespace mappings and collaborator permissions.
| Attribute | Description |
|---|---|
| Location | Database |
| Impact if compromised | Package takeover, typosquatting enablement |
| Protection | Ownership model, audit logs |
Private repositories and billing information.
| Attribute | Description |
|---|---|
| Location | Database |
| Impact if compromised | Data breach, unauthorized access |
| Protection | Access control, authentication requirements |
Records of security-relevant actions.
| Attribute | Description |
|---|---|
| Location | Database, log aggregation |
| Impact if compromised | Loss of forensic capability |
| Protection | Append-only, retention policies |
SBOM and provenance information.
| Attribute | Description |
|---|---|
| Location | Package metadata, external attestations |
| Impact if compromised | False provenance claims |
| Protection | Signed attestations (future) |
Service accounts and deployment keys.
| Attribute | Description |
|---|---|
| Location | Secrets management |
| Impact if compromised | Full system compromise |
| Protection | Rotation, least privilege, monitoring |
Impact ratings use CVSS v4.0 semantics:
- None - No impact
- Low - Limited impact
- High - Serious impact
| Asset | Confidentiality | Integrity | Availability |
|---|---|---|---|
| Package Artifacts | None | High | High |
| Registry Metadata | None | High | High |
| Registry Signing Key | High | High | High |
| Maintainer Accounts | High | High | Low |
| API Tokens | High | High | Low |
| Documentation Content | None | Low | Low |
| Package Ownership | Low | High | Low |
| Organization Data | High | High | Low |
| Audit Logs | Low | High | Low |
| Build Metadata | None | High | None |
| Infrastructure Credentials | High | High | High |