Zero plaintext after copying to memguard in DecryptWithIdentity (closes #5) #10

clawbot · 2026-02-08T21:06:01+01:00

clawbot skomentował(-a)

2026-02-08 21:06:01 +01:00

Zeroes the intermediate []byte slice after copying into the memguard.LockedBuffer to prevent decrypted secrets from lingering in unprotected heap memory.

Zeroes the intermediate `[]byte` slice after copying into the `memguard.LockedBuffer` to prevent decrypted secrets from lingering in unprotected heap memory.

sneak zostaje przypisany(-a) przez clawbot

2026-02-08 21:06:01 +01:00

clawbot dodał(-a) 1 commit 2026-02-08 21:06:02 +01:00

security: zero plaintext after copying to memguard in DecryptWithIdentity fd77a047f9

The decrypted data from io.ReadAll was copied into a memguard
LockedBuffer but the original byte slice was never zeroed, leaving
plaintext in swappable, dumpable heap memory.

sneak merged commit 6ffb24b544 into main

2026-02-09 02:18:06 +01:00

sneak wspomniał(-a) to zgłoszenie z commita

2026-02-09 02:18:07 +01:00

Merge pull request 'Zero plaintext after copying to memguard in DecryptWithIdentity (closes #5)' (#10) from clawbot/secret:fix/issue-5 into main

Zaloguj się, aby dołączyć do tej rozmowy.

Uczestnicy 1

Powiadomienia

Termin realizacji

Brak ustawionego terminu realizacji.

Zależności

No dependencies set.

Reference: sneak/secret#10