sendPayment() in src/services/stellar.ts (once wired to getSecretKey()) will hold the raw secret as a JS string through Keypair.fromSecret and signing. JS strings are immutable and often interned/retained by the engine's GC well past their last explicit reference, so "just let it go out of scope" is not a real mitigation — this needs an actual design decision (e.g. using a mutable byte buffer that can be explicitly overwritten, understanding Hermes's actual memory behavior) rather than assuming garbage collection equals erasure.
Definition of done:
- Written analysis of what Hermes actually does with short-lived string data (does anything currently give a real guarantee, or is this fundamentally unsolvable at the JS layer and needs to move to native code?)
- Best-achievable mitigation implemented and documented with its actual limitations stated plainly, not oversold
- No secret-shaped string literals left in any exception/error object that might be caught and logged elsewhere
Before opening a PR for this issue, read CONTRIBUTING.md.
This is not a starter-issue. The Definition of done above is the full
acceptance criteria, not a subset to sample from — a PR that addresses part
of it is an unfinished issue, not a smaller one. Your PR must include, in
the PR description itself:
PRs missing these will be sent back before review, not reviewed and rejected — please do this up front.
sendPayment()insrc/services/stellar.ts(once wired togetSecretKey()) will hold the raw secret as a JS string throughKeypair.fromSecretand signing. JS strings are immutable and often interned/retained by the engine's GC well past their last explicit reference, so "just let it go out of scope" is not a real mitigation — this needs an actual design decision (e.g. using a mutable byte buffer that can be explicitly overwritten, understanding Hermes's actual memory behavior) rather than assuming garbage collection equals erasure.Definition of done:
Before opening a PR for this issue, read CONTRIBUTING.md.
This is not a starter-issue. The Definition of done above is the full
acceptance criteria, not a subset to sample from — a PR that addresses part
of it is an unfinished issue, not a smaller one. Your PR must include, in
the PR description itself:
PRs missing these will be sent back before review, not reviewed and rejected — please do this up front.