From b6d95042c4419d2784bfb9b6dc3dfc3108e050e7 Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@codecow.com>
Date: Sun, 9 Aug 2026 11:58:34 -0700
Subject: [PATCH] Refactor secret buffers to enable proper zeroing.

---
 src/lib/vault/vault-worker.ts | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index cce4181..4364f48 100644
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -188,12 +188,18 @@ function derive (index?: number | Uint32Array): Promise<Record<string, number |
 		const promises = []
 		const values = typeof index === 'number' ? [index] : index.values()
 		for (const i of values) {
-			promises.push(_ckd(i).then(result => {
-				const prv = new Uint8Array(result)
-				const pub = nano25519_derive(prv)
-				prv.fill(0)
-				return { index: i, publicKey: pub.buffer }
-			}))
+			const prv = new Uint8Array(32)
+			promises.push(_ckd(i)
+				.then(result => {
+					prv.set(result)
+					result.fill(0)
+					const pub = nano25519_derive(prv)
+					return { index: i, publicKey: pub.buffer }
+				})
+				.finally(() => {
+					prv.fill(0)
+				})	
+			)
 		}
 		return Promise.all(promises)
 			.then(results => {
@@ -269,10 +275,11 @@ function sign (index?: Uint32Array, data?: ArrayBuffer): Promise<Record<string,
 		}
 		if (data == null) {
 			throw new VaultError('Data to sign not found')
-		}
+		const prv = new Uint8Array(32)
 		return _ckd(index[0])
 			.then(result => {
-				const prv = new Uint8Array(result)
+				prv.set(result)
+				result.fill(0)
 				const pub = nano25519_derive(prv)
 				const sk = new Uint8Array([...prv, ...pub])
 				prv.fill(0)
@@ -287,6 +294,9 @@ function sign (index?: Uint32Array, data?: ArrayBuffer): Promise<Record<string,
 				_timer.resume()
 				throw new VaultError('Failed to sign message', { cause: err })
 			})
+			.finally (() => {
+				prv.fill(0)
+			})
 	} catch (err) {
 		console.error(err)
 		_timer.resume()
-- 
2.52.0