You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Strengthen handling of sensitive data and update deferred security tracking metadata based on the latest automated scan.
New Features:
Improve password file reading to eliminate intermediate string copies, use Zeroizing for in-memory password data, and report invalid UTF-8 in password files.
Enhancements:
Apply Zeroizing wrappers to SHA-256 I/O buffers in CLI and GUI paths to reduce exposure of sensitive data in memory.
Documentation:
Update SECURITY_DEFER.md with refreshed attempt metadata and a new deferred Clippy quality issue in the crypto no-touch zone.
Summary by CodeRabbit
Security
Enhanced memory security by ensuring sensitive data is automatically wiped after use.
Improved error handling for password input with clearer distinction between file access and encoding errors.
Chores
Updated security audit tracking with latest vulnerability database information.
…ssues
- Improved `compute_sha256` in both GUI and CLI to use `Zeroizing` for buffers.
- Refactored CLI `read_password` from file to use `Zeroizing<String>` more securely and avoid intermediate non-zeroized copies.
- Updated `SECURITY_DEFER.md` with latest attempt counts and added new Clippy warnings found in the `src/crypto.rs` no-touch zone.
- Verified all code changes with `cargo check` and `cargo test`. Pre-existing Clippy warnings in no-touch zones are deferred.
Co-authored-by: darkmaster0345 <152901560+darkmaster0345@users.noreply.github.com>
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.
When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.
I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!
For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!
Implements security-scan fixes by zeroizing SHA-256 IO buffers, hardening password file reading to avoid non-zeroized intermediates and invalid UTF-8 panics, and updating deferred security issue metadata to reflect the latest scan and a new Clippy finding, without modifying the crypto no-touch zone.
Sequence diagram for hardened read_password flow using Zeroizing
sequenceDiagram
actor User
participant CLI as neuron_encrypt_cli
participant FS as fs
participant Z as Zeroizing
User->>CLI: parse_args(password_file)
CLI->>CLI: read_password(password_file)
alt password_file is Some(path)
CLI->>FS: read(path) (fs::read)
alt IO error
FS-->>CLI: Err(e)
CLI->>CLI: eprintln!("Error: Cannot read password file")
CLI->>CLI: std::process::exit(ExitCode::BadInput)
else success
FS-->>CLI: Ok(bytes)
CLI->>CLI: String::from_utf8(bytes)
alt invalid UTF8
CLI->>CLI: eprintln!("Error: Password file contains invalid UTF-8")
CLI->>CLI: std::process::exit(ExitCode::BadInput)
else valid UTF8
CLI-->>CLI: pw_string
CLI->>Z: Zeroizing::new(pw_string)
Z-->>CLI: pw_zeroized
CLI->>CLI: pw_zeroized.trim_end_matches(['\r','\n'])
CLI->>CLI: pw_zeroized.truncate(trimmed_len)
CLI-->>CLI: Zeroizing<String>
end
end
else password_file is None
CLI->>CLI: std::env::var("NEURON_PASSWORD")
CLI-->>CLI: Zeroizing<String> or error handling
end
CLI-->>User: use password in subsequent commands
Loading
File-Level Changes
Change
Details
Files
Harden password file reading to avoid intermediate copies and ensure password contents are zeroized in memory.
Switch password file reading from fs::read_to_string to fs::read to work with raw bytes first
Add explicit UTF-8 decoding with a dedicated error message and exit path on invalid encoding
Wrap the password String in Zeroizing before trimming newline characters
Trim trailing CR/LF by computing the trimmed length and truncating the Zeroizing in-place
neuron-encrypt/src/bin/cli.rs
Ensure SHA-256 read buffers are zeroized to reduce lifetime of sensitive data in memory.
Wrap the 64 KiB SHA-256 buffer in Zeroizing<[u8; 65536]> in both CLI and GUI implementations
Adjust file.read calls to use buf.as_mut_slice() instead of passing the array directly
Update deferred security issue tracking to reflect the latest scan run and new deferred Clippy finding.
Bump Last attempted dates and Attempt count values for existing deferred issues to 2026-05-30 and increment counts
Add a new deferred entry describing the manual .is_multiple_of() Clippy warning in src/crypto.rs with rationale and suggested fix
SECURITY_DEFER.md audit_output.json
Tips and commands
Interacting with Sourcery
Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment @sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment @sourcery-ai review to trigger a new review!
Your organization has run out of usage credits. Purchase more in the billing tab.
⌛ How to resolve this issue?
After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.
We recommend that you space out your commits to avoid hitting the rate limit.
🚦 How do rate limits work?
CodeRabbit enforces hourly rate limits for each developer per organization.
Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.
This PR hardens sensitive data handling in Neuron-Encrypt through buffer zeroization and improved password input validation. Security audit tracking metadata is refreshed, CLI password reading switches to explicit UTF-8 error handling with in-place string trimming, and both CLI and GUI compute_sha256 implementations now use Zeroizing wrappers to ensure temporary file buffers are automatically cleared from memory.
Deferred security findings advance with new attempt dates and counts; [CLIPPY_MANUAL_IS_MULTIPLE_OF] is added. Audit report metadata refreshes with updated advisory/dependency counts and timestamps.
read_password reads raw bytes and explicitly converts to UTF-8 with separate error paths; in-place truncation of Zeroizing<String> replaces the prior to_owned() pattern to avoid unzeroed temporaries.
Buffer zeroization for file hashing neuron-encrypt/src/bin/cli.rs, neuron-encrypt/src/gui.rs
Both CLI and GUI compute_sha256 functions switch from plain [u8; 65536] buffers to Zeroizing<[u8; 65536]>, ensuring temporary file data is automatically zeroed on scope exit.
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Possibly related PRs
darkmaster0345/Neuron-Encrypt#20: Modifies password/passphrase handling in neuron-encrypt/src/bin/cli.rs and extends zeroization-based hardening in the same CLI area.
Suggested labels
codex
Poem
🐰 Buffers whisper secrets, but not for long, Zeroization hushes each byte-sized song. Passwords trimmed in place, no copies left behind, Memory scrubbed clean, peace of mind. Security audit ledgers dutifully inscribed, Your data's safety—carefully described. 🔐
🚥 Pre-merge checks | ✅ 3 | ❌ 2
❌ Failed checks (1 warning, 1 inconclusive)
Check name
Status
Explanation
Resolution
Docstring Coverage
⚠️ Warning
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.
Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check
❓ Inconclusive
The title 'Security Scan — 2026-05-30' is vague and generic, using only a date without describing the actual security changes made (buffer zeroization and password handling improvements).
Consider a more descriptive title like 'Add Zeroizing wrapper to SHA-256 buffers and improve password file reading' to clarify the main security improvements.
✅ Passed checks (3 passed)
Check name
Status
Explanation
Description Check
✅ Passed
Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check
✅ Passed
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
✅ Passed
Check skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches🧪 Generate unit tests (beta)
Create PR with unit tests
Commit unit tests in branch security/weekly-scan-2026-05-30-3208231195590846619
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
The PR aims to harden sensitive data handling by wrapping buffers and passwords in Zeroizing types. However, a critical conflict exists: the implementation uses std::process::exit in read_password, which prevents the Zeroizing destructors from running, thereby leaving sensitive data in memory upon termination. Additionally, the password trimming logic using truncate fails to zero out the memory in the buffer's unused capacity, creating a data leak.
A security risk was also identified regarding the unmaintained paste crate (RUSTSEC-2024-0436). There is a significant gap in test coverage for the new hardening logic, particularly for error paths and memory clearing. While the PR is technically 'up to standards' according to Codacy, these logic flaws should be addressed to achieve the intended security benefits.
About this PR
The PR lacks automated unit or integration tests to verify the new password trimming logic, UTF-8 error handling, or the application of Zeroizing wrappers in both the CLI and GUI execution paths.
1 comment outside of the diffaudit_output.json
line 1 🟡 MEDIUM RISK
The paste crate is unmaintained and should be replaced to ensure long-term maintainability and security. pastey is a maintained fork that serves as a drop-in replacement.
Try running the following prompt in your IDE agent:
Replace the paste crate with pastey in Cargo.toml and update imports.
Test suggestions
Reading a password from a file containing trailing newlines and verifying they are correctly trimmed in-place within the Zeroizing wrapper.
Attempting to read a password from a file containing invalid UTF-8 bytes to verify the error message and exit status.
Verification that the SHA-256 buffer in the CLI is wrapped in Zeroizing to clear memory after hash computation.
Verification that the SHA-256 buffer in the GUI is wrapped in Zeroizing to clear memory after hash computation.
Unit test to ensure password file size limits are enforced to prevent OOM.
Unit test to verify zeroization of the buffer occurs upon UTF-8 decoding failure.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Reading a password from a file containing trailing newlines and verifying they are correctly trimmed in-place within the Zeroizing wrapper.
2. Attempting to read a password from a file containing invalid UTF-8 bytes to verify the error message and exit status.
3. Verification that the SHA-256 buffer in the CLI is wrapped in Zeroizing to clear memory after hash computation.
4. Verification that the SHA-256 buffer in the GUI is wrapped in Zeroizing to clear memory after hash computation.
5. Unit test to ensure password file size limits are enforced to prevent OOM.
6. Unit test to verify zeroization of the buffer occurs upon UTF-8 decoding failure.
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
Refactor the password reading logic to return a Result instead of calling std::process::exit. This allows the application to clean up sensitive data as variables go out of scope before the process terminates. Try running the following prompt in your coding agent: > Refactor read_password in neuron-encrypt/src/bin/cli.rs to return Result<Zeroizing<String>, String> instead of calling std::process::exit, and update the caller to handle the error and exit from main to ensure destructors run.
The reason will be displayed to describe this comment to others. Learn more.
🟡 MEDIUM RISK
Suggestion: To ensure truncated characters are cleared, manually zero the trailing portion of the buffer before truncating or avoid the in-place modification. Try running the following prompt in your coding agent: > Modify the password trimming in neuron-encrypt/src/bin/cli.rs to zero out the bytes being truncated from the Zeroizing<String> before calling truncate, or refactor to return the untrimmed string and handle trimming at the point of use.
…ssues
- Improved `compute_sha256` in both GUI and CLI to use `Zeroizing` for buffers.
- Refactored CLI `read_password` from file to use `Zeroizing<String>` more securely and avoid intermediate non-zeroized copies.
- Fixed compilation errors in Android JNI (`android/neuron-encrypt-jni/src/lib.rs`) by properly handling `JavaVM` ownership and ensuring exhaustive error matching.
- Updated `SECURITY_DEFER.md` with latest attempt counts and added new Clippy warnings found in the `src/crypto.rs` no-touch zone.
- Verified all code changes with `cargo check` (including JNI) and `cargo test`. Pre-existing Clippy warnings in no-touch zones are deferred.
- Respected no-touch zones: `src/crypto.rs` and `Cargo.lock` files were not modified.
Co-authored-by: darkmaster0345 <152901560+darkmaster0345@users.noreply.github.com>
…, and update deferred issues
- Improved `compute_sha256` in both GUI and CLI to use `Zeroizing` for buffers.
- Refactored CLI `read_password` from file to use `Zeroizing<String>` more securely and avoid intermediate non-zeroized copies.
- Fixed compilation errors in Android JNI (`android/neuron-encrypt-jni/src/lib.rs`) by properly handling `JavaVM` ownership and ensuring exhaustive error matching.
- Fixed Android Kotlin UI compilation errors by removing the unused `onAbout` parameter in `MainActivity.kt` and adding the missing import for `tabIndicatorOffset` in `BatchScreen.kt` and `SingleFileScreen.kt`.
- Updated `SECURITY_DEFER.md` with latest attempt counts and added new Clippy warnings found in the `src/crypto.rs` no-touch zone.
- Verified all code changes with `cargo check`, `cargo test`, and `./gradlew assembleDebug`. Pre-existing Clippy warnings in no-touch zones are deferred.
- Respected no-touch zones: `src/crypto.rs` and `Cargo.lock` files were not modified.
Co-authored-by: darkmaster0345 <152901560+darkmaster0345@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Security Scan Results — 2026-05-30
FIXED ISSUES (3)
[Medium] neuron-encrypt/src/gui.rs:24 — added Zeroizing wrapper to SHA-256 buffer
[Medium] neuron-encrypt/src/bin/cli.rs:400 — added Zeroizing wrapper to SHA-256 buffer
[High] neuron-encrypt/src/bin/cli.rs:110 — improved password file reading to use Zeroizing and avoid intermediate copies
DEFERRED ISSUES (5)
[Critical] neuron-encrypt/src/crypto.rs:114 — Insufficient Argon2id memory cost — no-touch zone
[Medium] neuron-encrypt/src/crypto.rs:116 — Unhandled unwrap() calls in crypto-adjacent paths — no-touch zone
[Medium] Cargo.lock — Unmaintained dependency: paste — no-touch zone
[Medium] neuron-encrypt/src/crypto.rs:274 — Unsafe fallback in tmp_path — no-touch zone
[Medium] neuron-encrypt/src/crypto.rs:489,898 — Manual implementation of .is_multiple_of() — no-touch zone
See SECURITY_DEFER.md for full details.
DEFERRED FILE CHANGES
New entries added: 1
Fixed entries removed: 0
Existing entries updated (attempt count): 4
TESTING
cargo check — passed
cargo clippy — failed (deferred issues in no-touch zone)
cargo test — passed
NO-TOUCH ZONES RESPECTED
src/crypto.rs — not modified
NEXT STEPS FOR HUMAN
[Critical] neuron-encrypt/src/crypto.rs:114 — Insufficient Argon2id memory cost needs human review and Argon2 parameters update.
PR created automatically by Jules for task 3208231195590846619 started by @darkmaster0345
Summary by Sourcery
Strengthen handling of sensitive data and update deferred security tracking metadata based on the latest automated scan.
New Features:
Enhancements:
Documentation:
Summary by CodeRabbit
Security
Chores