From 19fa47acbda55ac7bd78b1f10cf4e891fcdcdd13 Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@codecow.com>
Date: Tue, 4 Aug 2026 23:34:03 -0700
Subject: [PATCH] Zero out password on both success and error paths.

---
 src/lib/vault/passkey.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/lib/vault/passkey.ts b/src/lib/vault/passkey.ts
index a3c5806..daf6d87 100644
--- a/src/lib/vault/passkey.ts
+++ b/src/lib/vault/passkey.ts
@@ -21,7 +21,6 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
 		return crypto.subtle
 			.importKey('raw', password, 'PBKDF2', false, ['deriveKey'])
 			.then(derivationKey => {
-				new Uint8Array(password).fill(0)
 				const derivationAlgorithm: Pbkdf2Params = {
 					name: 'PBKDF2',
 					hash: 'SHA-512',
@@ -39,6 +38,9 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
 				console.error(err)
 				throw new Error('Failed to derive CryptoKey from password', { cause: err })
 			})
+			.finally(() => {
+				new Uint8Array(password).fill(0)
+			})
 	} else if (data.password !== undefined) {
 		throw new Error('Password is not allowed for this action', { cause: action })
 	} else {
-- 
2.52.0