From: Chris Duncan <chris@codecow.com>
Date: Wed, 5 Aug 2026 06:34:03 +0000 (-0700)
Subject: Zero out password on both success and error paths.
X-Git-Url: https://git.codecow.com/?a=commitdiff_plain;h=19fa47acbda55ac7bd78b1f10cf4e891fcdcdd13;p=libnemo.git

Zero out password on both success and error paths.
---

diff --git a/src/lib/vault/passkey.ts b/src/lib/vault/passkey.ts
index a3c5806..daf6d87 100644
--- a/src/lib/vault/passkey.ts
+++ b/src/lib/vault/passkey.ts
@@ -21,7 +21,6 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
 		return crypto.subtle
 			.importKey('raw', password, 'PBKDF2', false, ['deriveKey'])
 			.then(derivationKey => {
-				new Uint8Array(password).fill(0)
 				const derivationAlgorithm: Pbkdf2Params = {
 					name: 'PBKDF2',
 					hash: 'SHA-512',
@@ -39,6 +38,9 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
 				console.error(err)
 				throw new Error('Failed to derive CryptoKey from password', { cause: err })
 			})
+			.finally(() => {
+				new Uint8Array(password).fill(0)
+			})
 	} else if (data.password !== undefined) {
 		throw new Error('Password is not allowed for this action', { cause: action })
 	} else {