Severity: high
Type: security
Location: clipsync/ui.py — _SettingsContent._on_save_passphrase() (~line 850); clipsync/config.py — DEFAULT_SETTINGS (~line 110), Settings._persist_locked() (~line 215)
Problem: The raw encryption_passphrase is written verbatim into settings.json. Anyone who can read that file can decrypt every synced clipboard payload. On Windows, os.chmod(0o600) does not set restrictive ACLs, so the file is often readable by other local users, further undermining the “defense-in-depth” encryption goal.
Suggested fix: Do not persist the raw passphrase. Derive the Fernet key when the user enters the passphrase and store only the derived key, or prompt for the passphrase on startup and keep it in memory. At minimum, encrypt the passphrase with the OS keyring before writing it to disk.
Filed from a full-source audit of the repo (2026-07-29). Independently confirmed against the source before filing.
Severity: high
Type: security
Location:
clipsync/ui.py—_SettingsContent._on_save_passphrase()(~line 850);clipsync/config.py—DEFAULT_SETTINGS(~line 110),Settings._persist_locked()(~line 215)Problem: The raw
encryption_passphraseis written verbatim intosettings.json. Anyone who can read that file can decrypt every synced clipboard payload. On Windows,os.chmod(0o600)does not set restrictive ACLs, so the file is often readable by other local users, further undermining the “defense-in-depth” encryption goal.Suggested fix: Do not persist the raw passphrase. Derive the Fernet key when the user enters the passphrase and store only the derived key, or prompt for the passphrase on startup and keep it in memory. At minimum, encrypt the passphrase with the OS keyring before writing it to disk.
Filed from a full-source audit of the repo (2026-07-29). Independently confirmed against the source before filing.