From 321cd9365fbc2c68d405aca8ffb0cc3dfdd10b90 Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@codecow.com>
Date: Sun, 9 Aug 2026 22:04:18 -0700
Subject: [PATCH] Password paranoia.

---
 src/lib/vault/passkey.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/lib/vault/passkey.ts b/src/lib/vault/passkey.ts
index 6f82549..22102e7 100644
--- a/src/lib/vault/passkey.ts
+++ b/src/lib/vault/passkey.ts
@@ -21,6 +21,7 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
 		return crypto.subtle
 			.importKey('raw', password, 'PBKDF2', false, ['deriveKey'])
 			.then(derivationKey => {
+				new Uint8Array(password).fill(0)
 				const derivationAlgorithm: Pbkdf2Params = {
 					name: 'PBKDF2',
 					hash: 'SHA-512',
@@ -35,6 +36,9 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
 					.deriveKey(derivationAlgorithm, derivationKey, derivedKeyType, false, keyUsages)
 			})
 			.catch(err => {
+				// DO NOT LOG ERRORS HERE, avoid leaking the password
+				new Uint8Array(password).fill(0)
+				Object.keys(err).forEach(key => delete err[key])
 				throw new Error('Failed to derive CryptoKey from password')
 			})
 			.finally(() => {
-- 
2.52.0