Threat model for the basecrawl crawler image and SDK. States the honesty model and the TEE.fail residual with managed-cloud mitigation. Companions: tcb-inventory.md, image-rotation-on-cve.md, TRUST_MODEL.md, architecture.md.
Authenticity is cryptographically-anchored trust-but-audit. A scrape is authentic under:
- TEE vendor honest and host not physically compromised; or
- honest witness + clean network path; or
- honest-majority audit + slashing.
Do not claim absolute authenticity for this engine. Security enforcement is the verifier (L1 measurement allowlist + L2 report_data binding), not merely shipping the binary. A bare SDK outside an allowlisted TEE proves nothing.
Do not claim absolute TEE security for basecrawl or companion platforms. Prefer precise residual wording over absolute-trust vocabulary.
Residual: a self-hosted DDR5 bus interposer can forge quotes and read enclave memory. There is no vendor fix. When operators self-host the CVM, a physical interposer adversary can undermine both quote authenticity and content-confidentiality.
Managed-cloud mitigation: run high-reward and confidential workloads on a managed-cloud TEE (for example Phala TDX) where the operator does not control bus access. Consumer scoring may weight managed-cloud higher and audit self-hosted harder. This does not make the TEE absolute; it is the operational answer to the residual while authenticity remains cryptographically-anchored trust-but-audit.
The measured TCB is minimized and enumerated in tcb-inventory.md. Measurement matching proves image identity, not that Chromium/OS code is free of unknown vulnerabilities. A measured-but-exploited residual is acknowledged; the backstop is replay-audit sampling plus the image rotation runbook in image-rotation-on-cve.md.
On the sealed/TEE path, basecrawl aims for content-confidentiality (host does not see path/query/headers/cookies/body/result plaintext), not target-anonymity. Destination IP, SNI (absent ECH), DoH resolver destination, and traffic metadata remain expected residual leakage to a proxy-operating host.
Universal proxy support (HTTP CONNECT / SOCKS5, sticky/session and country username tokens) and the Chromium hard-path composer improve operational success. They do not make scrapes anonymous, and they do not defeat every commercial bot system.
| Residual | Notes |
|---|---|
| Upstream proxy operator | Sees exit traffic to origins; credentials must stay env-only, never in proofs or logs. |
| Network metadata | Even with sealed DoH on the hard path, traffic shape and destination residual exist outside content confidentiality. |
| Headless / automation heuristics | Stealth baseline lowers trivial signals (webdriver, obvious automation flags); sites may still classify the client. |
| Class forgery | Product fails closed when residential/mobile is required but upstream is unavailable; never advertise a forged class on success. |
Operator flag reference: operators/proxy-and-egress.md.
--formats json is request syntax only when no live extractor/provider is configured. The engine reports structured structured_extraction_unsupported / invalid_json_schema rather than inventing schema fields. Optional provider keys (BASECRAWL_EXTRACT_API_KEY, OPENAI_API_KEY) do not authorize empty fake success. See operators/product-breadth-and-extract.md.
- Prefer managed-cloud placement for confidential scrapes.
- Keep image builds reproducible and digest-pinned; rotate on CVE per image-rotation-on-cve.md.
- Never advertise absolute-trust language in tooling or docs.
- Keep proxy and LLM/extract keys in gitignored env files; never in ScrapeProof or CI logs.
- Treat residential success as topology improvement, not anonymity.