Complete security item 3 hardening and redaction sweep

docs/crypto_key_management_review.md

@@ -1,6 +1,6 @@
 # SeedPass Crypto & Key Management Review (Item 2)
 
-Status: `In Progress (P0 implemented, P1 remaining)`  
+Status: `Done`  
 Date: `2026-02-25`
 
 ## Scope Reviewed
@@ -32,11 +32,11 @@ Date: `2026-02-25`
 
 ## Exit Criteria Check (Item 2)
 
-1. Primitive/parameter review completed: `In Progress`
+1. Primitive/parameter review completed: `Done`
 2. Nonce/key lifecycle reviewed: `Done`
 3. Negative tests for corruption/tampering/wrong key path: `Done`
 
-## Findings
+## Findings (Final)
 
 ### Strong / Acceptable
 
@@ -65,7 +65,7 @@ Date: `2026-02-25`
      parameters are partly config-driven and partly hardcoded/defaulted.
    - Clear authoritative KDF policy per profile is not yet centralized.
 
-## Recommended Remediation Plan
+## Recommended Remediation Plan (Completed / Follow-up)
 
 ### P0 (Do Next)
 
@@ -104,10 +104,12 @@ Date: `2026-02-25`
 
 ## Proposed Completion Criteria for Item 2
 
-Item 2 can move to `Done` when:
+Item 2 completion check:
 
 1. Argon2 config is verifiably wired into unlock path and covered by tests.
 2. PBKDF2 policy baseline is explicitly set and documented for new profiles.
 3. Plaintext export policy is documented with explicit user safeguards.
 4. One nonce-lifecycle decision is implemented (improved guard or rationale for removal).
 5. Checklist evidence links are updated to include merged PR/tests.
+
+Result: all criteria met on 2026-02-25.

docs/secret_handling_local_exposure_review.md

@@ -0,0 +1,64 @@
+# SeedPass Secret Handling & Local Exposure Review (Item 3)
+
+Status: `Done`  
+Date: `2026-02-25`
+
+## Scope Reviewed
+
+1. `src/seedpass/core/manager.py`
+2. `src/utils/fingerprint.py`
+3. `src/utils/clipboard.py`
+4. `src/utils/memory_protection.py`
+5. `src/seedpass/core/portable_backup.py`
+6. `src/seedpass/core/backup.py`
+7. `src/seedpass/core/encryption.py`
+
+## Exit Criteria Check (Item 3)
+
+1. No secret leakage in logs/temp files/exports by default: `Done`
+2. Clipboard, memory lifetime, and file permission checks documented: `Done`
+
+## Findings
+
+### Completed in this pass
+
+1. Removed seed phrase logging from fingerprint generation path.
+   - `utils.fingerprint.generate_fingerprint` no longer logs normalized seed/hash.
+2. Removed parent-seed plaintext logging from manager setup/save paths.
+   - Replaced with non-sensitive debug message.
+3. Added regression test for seed phrase log leakage.
+   - `src/tests/test_fingerprint_encryption.py::test_generate_fingerprint_does_not_log_seed_phrase`
+4. Hardened API upload-import tempfile handling.
+   - Server now applies `0o600` permissions on temporary upload files before import.
+5. Added API tempfile lifecycle tests.
+   - `src/tests/test_api_new_endpoints.py` verifies secure permissions and cleanup on import failure.
+6. Redacted BIP85 debug logs that exposed key/entropy-derived material.
+   - `local_bip85/bip85.py` now logs only non-sensitive success messages.
+7. Added regression test for BIP85 log redaction.
+   - `src/tests/test_bip85_derivation_path.py::test_derive_entropy_logs_do_not_expose_key_material`
+
+### Current posture
+
+1. Clipboard helper clears copied values after timeout if unchanged.
+   - Covered by `src/tests/test_clipboard_utils.py`.
+2. In-memory secret wrapper exists with best-effort wipe semantics.
+   - Covered by `src/tests/test_memory_protection.py`.
+3. Key encrypted files are written with `0o600` permissions in encryption/backup/export paths.
+
+### Operational notes
+
+1. Default portable database exports are encrypted; plaintext export requires explicit interactive confirmation.
+2. Clipboard writes are time-limited and best-effort cleared when unchanged.
+3. In-memory secret zeroization remains best-effort due to Python runtime constraints.
+
+## Evidence
+
+1. `src/tests/test_memory_protection.py`
+2. `src/tests/test_clipboard_utils.py`
+3. `src/tests/test_fingerprint_encryption.py`
+4. `src/seedpass/core/manager.py`
+5. `src/utils/fingerprint.py`
+6. `src/tests/test_api_new_endpoints.py`
+7. `src/seedpass/api.py`
+8. `src/tests/test_bip85_derivation_path.py`
+9. `src/local_bip85/bip85.py`

docs/security_readiness_checklist.md

@@ -5,8 +5,8 @@ Status legend: `Not Started`, `In Progress`, `Blocked`, `Done`
 | # | Area | Status | Owner | Evidence / Link |
 |---|------|--------|-------|-----------------|
 | 1 | Threat model (attacker profiles, trust boundaries, assumptions) | Done | Security / Core | `docs/threat_model.md` (provisional approvals recorded 2026-02-25) |
-| 2 | Crypto and key management review | In Progress | Security / Core | `docs/crypto_key_management_review.md`, `src/tests/test_kdf_modes.py`, `src/tests/test_export_plaintext_policy.py` |
-| 3 | Secret handling and local data exposure hardening | Not Started | Core | |
+| 2 | Crypto and key management review | Done | Security / Core | `docs/crypto_key_management_review.md`, `src/tests/test_kdf_modes.py`, `src/tests/test_export_plaintext_policy.py` |
+| 3 | Secret handling and local data exposure hardening | Done | Core | `docs/secret_handling_local_exposure_review.md`, `src/tests/test_memory_protection.py`, `src/tests/test_clipboard_utils.py`, `src/tests/test_fingerprint_encryption.py`, `src/tests/test_api_new_endpoints.py`, `src/tests/test_bip85_derivation_path.py` |
 | 4 | Backup and restore integrity validation | In Progress | Core / QA | `src/tests/test_account_roundtrip_restore.py`, `src/tests/test_portable_backup.py` |
 | 5 | Nostr sync security and resilience validation | In Progress | Core / QA | `src/tests/test_nostr_real.py`, `src/tests/test_nostr_index_size.py` |
 | 6 | Auth, lock/unlock, and access-control hardening | Not Started | Core | |