mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-11-01 18:32:05 +00:00
31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
# Memory Update (2026-02-25)
|
|
|
|
## Security Checklist Progress
|
|
- Item 2 (`Crypto and key management review`) remains `Done`.
|
|
- Item 3 (`Secret handling and local data exposure hardening`) moved to `Done`.
|
|
|
|
## Item 3 Final Hardening Completed
|
|
1. Log redaction:
|
|
- Removed seed phrase logging from `utils/fingerprint.py`.
|
|
- Removed parent-seed plaintext debug logging from `seedpass/core/manager.py`.
|
|
- Redacted BIP85 debug logs that previously exposed child-key/entropy-derived material in `local_bip85/bip85.py`.
|
|
2. Temp-file hardening:
|
|
- Upload import path in `seedpass/api.py` now enforces `chmod 0o600` before processing.
|
|
3. Regression coverage added:
|
|
- `test_generate_fingerprint_does_not_log_seed_phrase`.
|
|
- `test_vault_import_upload_sets_secure_temp_permissions`.
|
|
- `test_vault_import_upload_temp_file_removed_on_failure`.
|
|
- `test_derive_entropy_logs_do_not_expose_key_material`.
|
|
|
|
## Validation
|
|
- Executed:
|
|
- `src/tests/test_bip85_derivation_path.py`
|
|
- `src/tests/test_api_new_endpoints.py`
|
|
- `src/tests/test_fingerprint_encryption.py`
|
|
- `src/tests/test_memory_protection.py`
|
|
- `src/tests/test_clipboard_utils.py`
|
|
- Result: `37 passed`.
|
|
|
|
## Next Checklist Item
|
|
- Next highest-priority `Not Started` item is #6: Auth, lock/unlock, and access-control hardening.
|