MigrateSafe

Read-only security audit for domain migrations.

When a web platform moves from old.example to new.example, there is a window in which two names, two hosting environments and two sets of DNS, TLS and e-mail settings coexist. MigrateSafe checks that window for dangling records, certificate anomalies, transport/session downgrades, spoofable mail, broken redirects and configuration drift.

It implements the fourteen verification checks (C1–C14) from:

A. A. More, “MigrateSafe: A threat model and verification framework for secure domain migration of web-hosted cryptocurrency trading platforms,” Zenodo, preprint, Oct. 2026, doi: 10.5281/zenodo.23576774.

Install

Requires Python 3.9+ and dnspython.

pip install migratesafe

Or run from a checkout without installing (dnspython must be available):

python3 -m migratesafe audit --new new.example --old old.example

Usage

# full audit of a completed migration
migratesafe audit --new new.example --old old.example

# only the checks that matter up to a given phase (P0 preparation ... P4 retirement)
migratesafe audit --new new.example --old old.example --phase P1

# a subset of checks, with a JSON report for CI or record keeping
migratesafe audit --new new.example --checks C5,C9,C13 --json report.json

# include a scan of the application source for leftover references to the old name
migratesafe audit --new new.example --old old.example --project ~/code/exchange --config migratesafe.json

migratesafe list

Exit codes: 0 all passed, 1 warnings or errors, 2 at least one failure, which makes it usable as a CI gate.

Checks

Threat classes: T1 dangling records / subdomain takeover, T2 residual trust, T3 delegation hijack, T4 certificate anomalies, T5 transport/session downgrade, T6 e-mail spoofing, T7 lookalike domains, T8 configuration drift.

CT data comes from the public crt.sh service, which can lag behind the logs by hours and occasionally returns incomplete results; treat C1/C6 output as a lower bound and re-run if crt.sh is unavailable.

Some things cannot be observed from outside (revoked sessions, provider dashboards, registrar MFA); those are reported as MANUAL items so they still appear on the checklist.

Configuration (optional)

See example-config.json:

{
  "inventory": {"new.example": "migrate", "www.new.example": "migrate", "status.old.example": "delete"},
  "allowed_issuers": ["Let's Encrypt"],
  "dkim_selectors": ["default"],
  "old_host_ip": "203.0.113.10",
  "dnssec_exception": false,
  "old_domain_mail": "retired",
  "session_paths": ["/", "/login"],
  "config_ignore": ["CHANGELOG.md"]
}

Safety and ethics

MigrateSafe is read-only. It performs ordinary DNS queries, HTTPS requests and TLS handshakes, and reads public CT and RDAP data. It never claims resources, requests certificates or modifies anything. Values of secret-looking keys are masked when .env lines are reported. Only audit domains you own or are authorised to test.

Evaluation (fault injection)

evaluation/ runs all fourteen checks, unchanged, against a simulated Internet (DNS, HTTP, TLS, CT and RDAP in memory). It starts from a correctly migrated baseline and injects 28 faults covering threats T1–T8:

python3 -m evaluation.run      # writes evaluation/results.md and results.json

Current result: 27/28 faults flagged by the expected check, 1 (registered lookalike) reported as INFO by design, and 0 false positives on the baseline. See evaluation/results.md for the per-fault table and limitations.

Tests

python3 -m unittest discover -s tests -v

Author

Er. Abhijeet Ashok More (myabhya). Director, Cyin Solutions Pvt Ltd; Founder, Sumantrak. ORCID 0009-0001-4934-0204 · Google Scholar · LinkedIn

Citation

@misc{more2026migratesafe,
  author       = {More, Abhijeet Ashok},
  title        = {MigrateSafe: A Threat Model and Verification Framework for Secure Domain
                  Migration of Web-Hosted Cryptocurrency Trading Platforms},
  year         = {2026},
  publisher    = {Zenodo},
  doi          = {10.5281/zenodo.23576774},
  note         = {Preprint}
}

License

MIT, see LICENSE.