From d9e6cfa4954ee81625a910c9d9a937150f9a03f7 Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@codecow.com>
Date: Wed, 5 Aug 2026 01:42:05 -0700
Subject: [PATCH] Explicitly assign buffers to enable explicit zeroing.

---
 src/lib/crypto/wallet-aes-gcm.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/lib/crypto/wallet-aes-gcm.ts b/src/lib/crypto/wallet-aes-gcm.ts
index 069578c..1e951c8 100644
--- a/src/lib/crypto/wallet-aes-gcm.ts
+++ b/src/lib/crypto/wallet-aes-gcm.ts
@@ -37,11 +37,16 @@ export class WalletAesGcm {
 		// restrict iv to 96 bits per GCM best practice
 		const iv = crypto.getRandomValues(new Uint8Array(12)).buffer
 		const additionalData = utf8.toBuffer(`${type};${id}`)
-		const encoded = new Uint8Array([...new Uint8Array(seed), ...new Uint8Array(mnemonic ?? [])])
+		const s = new Uint8Array(seed)
+		const m = new Uint8Array(mnemonic ?? [])
+		const encoded = new Uint8Array([...s, ...m])
+		s.fill(0)
+		m.fill(0)
 		return crypto.subtle
 			.encrypt({ name: 'AES-GCM', iv, additionalData }, key, encoded)
 			.then(encrypted => {
 				encoded.fill(0)
+				key
 				return { iv, encrypted }
 			})
 	}
-- 
2.52.0