Data Handling, File I/O, Privacy & Encryption Audit

Audit Date: 2026-04-28 Codebase: scorpiox/clang (C) Auditor: Security Audit Agent Scope: File I/O, PII, credential management, encryption, temporary files, logging, data retention

---

1. Executive Summary

The scorpiox codebase is a large C project (~100+ non-vendor source files) implementing an AI coding assistant with TUI, multiplexer, email server, DNS server, container runtime, and SDK components. The audit identified several critical findings around hardcoded credentials in the WASM embedded config, plaintext config files storing API keys and SSH passwords, and unsalted SHA256 password hashing in the email module. Traffic logging correctly redacts authorization headers in most providers, but the OpenAI provider logs request URLs without API key redaction when keys are passed via URL. Session data (conversations, traces, events) is stored unencrypted on the local filesystem.

Risk Rating: HIGH — Primarily due to hardcoded secrets in compiled binaries and weak password hashing.

---

2. Data Flow Summary

User Input → TUI (sx.c)
    ├→ Configuration (sx_config.c) ← scorpiox-env.txt (3 cascade levels)
    ├→ Provider (sx_provider_*.c) → HTTP/TLS → External API
    │     ├→ Traffic Logs (.scorpiox/sessions/<id>/traffic/)
    │     └→ API Keys from config / env vars / embedded config
    ├→ Session Manager (sx_session.c)
    │     ├→ conversation.json (full history)
    │     ├→ session.log (debug output)
    │     ├→ events.jsonl (structured events)
    │     ├→ trace.jsonl (data flow trace)
    │     ├→ config-snapshot.txt (frozen config)
    │     └→ meta.json (metadata)
    ├→ Conversation Store (.scorpiox/conversations/*.json)
    ├→ Email Server (sxmail_*.c) → Maildir format
    │     ├→ Auth accounts file (user:hash)
    │     └→ TLS via mbedTLS
    ├→ Multiplexer (sxmux_*.c) → Unix domain sockets in /tmp/sxmux/
    ├→ Usage Tracking → POST to code.scorpiox.net/usage-send
    └→ Session Emit → POST to code.scorpiox.net/sessions-send

---

3. File I/O Inventory

3.1 Configuration Files

3.2 Session & Conversation Files

3.3 Email Server Files

3.4 Multiplexer Files

3.5 WhatsApp Bridge Files

3.6 Other Files

---

4. PII Assessment

4.1 Data Collected and Transmitted

The usage tracking system (scorpiox-usage.c) sends the following to code.scorpiox.net/usage-send:

Mitigation: Usage tracking is configurable (USAGE_TRACKING=0 to disable, default: 0 in embedded). Session emit tracking is also opt-in (EMIT_SESSION_TRACKING, default: 0).

4.2 Email Server PII

The email server inherently handles PII:

• Email addresses (From/To headers)
• Email body content
• User credentials (username + password hash)
• Failed login usernames are logged: SX_WARN("[auth] failed login for user: %s", user)
• Unknown user names are logged: SX_WARN("[auth] unknown user: %s", user)

4.3 Conversation Data

All user prompts and AI responses are stored in plaintext JSON files under .scorpiox/sessions/ and .scorpiox/conversations/. No encryption at rest is applied. Users may inadvertently share passwords, tokens, or other secrets in conversations, which are then persisted to disk.

---

5. Credential Management

5.1 CRITICAL: Hardcoded Secrets in Embedded Config

File: scorpiox/libsxutil/sx_config_embedded.c Severity: 🔴 CRITICAL

The WASM embedded config contains hardcoded API keys and SSH credentials compiled into the binary:

These secrets are extractable from the compiled WASM binary by any user.

5.2 Config File Credential Storage

File: scorpiox/libsxutil/sx_config.c Severity: 🟠 HIGH

The scorpiox-env.txt config cascade stores credentials in plaintext:

ANTHROPIC_API_KEY=sk-...
CLAUDE_CODE_SSH_PASS=...
CODEX_SSH_PASS=...
SMTP_PASS=...
GEMINI_API_KEY=AIza...
OPENAI_API_KEY=sk-...

Issues:

• Config files created with default 0755 directory permissions (via sx_mkdir) — too permissive for credential storage
• No file-level encryption of sensitive values
• Config snapshot written to session directory may expose keys

5.3 Non-Embedded Defaults

The non-embedded config defaults (sx_config.c) are mostly empty for sensitive keys:

• ANTHROPIC_API_KEY → "" ✅
• OPENAI_API_KEY → "xxx" ⚠️ (placeholder but non-empty)
• All SSH passwords → "" ✅

5.4 API Key Handling in Providers

5.5 Token Fetch Mechanism

scorpiox-claudecode-fetchtoken.c fetches OAuth tokens via:

Raw TCP (no TLS) to proxy.scorpiox.net:9800 — HIGH RISK: tokens transmitted in cleartext

SSH tunnel to remote host

HTTP endpoint

---

6. Encryption Usage

6.1 TLS Implementation (Email Server)

Library: mbedTLS (vendored) File: scorpiox/sxmail_tls.c

• Uses mbedtls_ssl_config, mbedtls_x509_crt, mbedtls_pk_context
• Entropy sourced from mbedtls_entropy_func → mbedtls_ctr_drbg_seed
• TLS configuration for both SMTP STARTTLS and implicit TLS (IMAP)
• Supports TLS accept (server) and upgrade (STARTTLS)
• ✅ Proper TLS implementation using mbedTLS

6.2 DKIM Signing

File: scorpiox/sxmail_dkim.c

• Algorithm: rsa-sha256
• Canonicalization: relaxed/relaxed
• Uses mbedTLS mbedtls_pk_context, mbedtls_sha256, mbedtls_base64
• CSPRNG via mbedtls_ctr_drbg
• ✅ Standard RFC 6376 implementation

6.3 Password Hashing

File: scorpiox/sxmail_auth.c Severity: 🟠 HIGH

int sxmail_auth_hash_password(const char pass, char out, size_t out_sz) {
    unsigned char digest[32];
    mbedtls_sha256((const unsigned char *)pass, strlen(pass), digest, 0);
    // ... hex encode ...
}

Issues:

• ❌ Unsalted SHA256 — vulnerable to rainbow tables and precomputation attacks
• ❌ No key stretching — SHA256 is too fast for password hashing; should use bcrypt, scrypt, or Argon2
• ❌ No per-user salt — identical passwords produce identical hashes

Positive: sxmail_auth_free() properly zeroes sensitive data with memset() before free().

6.4 Data at Rest Encryption

• ❌ No encryption at rest for conversation data
• ❌ No encryption at rest for config files (including API keys)
• ❌ No encryption at rest for email storage (Maildir)
• ❌ No encryption at rest for session logs/traces

---

7. Temporary File Security

7.1 Editor Temp Files

File: scorpiox/sx.c, line 612

snprintf(tmpfile, sizeof(tmpfile), "%s%csx-edit-%d.txt", ...);
FILE *f = fopen(tmpfile, "wb");

• ⚠️ Uses predictable filenames (sx-edit-.txt) — susceptible to symlink attacks
• ❌ Does not use mkstemp() for secure temp file creation
• File is cleaned up after use (read back and deleted)

7.2 Session Emit Temp Files

File: scorpiox/sx.c, line 1285

snprintf(tmp_file, sizeof(tmp_file), "/tmp/sx_emit_%s_%04d.txt", ...);

• ⚠️ Predictable filename in world-accessible /tmp
• ❌ No mkstemp() usage

7.3 Maildir Temp Files

File: scorpiox/sxmail_maildir.c

• ✅ Uses Maildir standard tmp/ → new/ atomic rename pattern
• ✅ Temp files are cleaned up on error (remove(tmp_path))
• ⚠️ Unique filenames based on timestamp+counter+PID — reasonably unique but not cryptographically random

7.4 Multiplexer Socket/PID Files

• ✅ Socket directory created with 0700 permissions
• ✅ Stale PID files and sockets are cleaned up
• ✅ Socket path in /tmp/sxmux/ (restricted directory)

---

8. Logging Analysis

8.1 Logging Framework

Files: scorpiox/libsxutil/sx_log.c, sx_log.h

• Levels: ERROR, WARN, INFO, DEBUG, TRACE
• Output: configurable file (append mode) or stderr
• Timestamps with millisecond precision
• Session-specific log files (.scorpiox/sessions//session.log)

8.2 Sensitive Data in Logs

8.3 Config Snapshot Risk

sx_session_write_config_snapshot() writes the full configuration to config-snapshot.txt in the session directory. If API keys are configured, they will be written to this file in plaintext.

---

9. Environment Variable Usage

9.1 Sensitive Environment Variables

9.2 All Environment Variables Read

The codebase reads 59 unique environment variables via getenv(). Notable categories:

• Authentication: ANTHROPIC_API_KEY, GEMINI_API_KEY, OPENAI_API_KEY, AGENTS_PAT
• User identity: USER, USERNAME, LOGNAME, HOME, USERPROFILE
• System: SHELL, EDITOR, VISUAL, TERM, PATH, TZ, PROCESSOR_ARCHITECTURE
• Application: SCORPIOX_HOME, SCORPIOX_BRANCH, CONTAINER_PACKAGES, SCORPIOX_PERF
• Search config: SCORPIOX_SEARCH_WAIT, SCORPIOX_SEARCH_ENGINES, SCORPIOX_SEARCH_NUM
• Traffic: OPENAI_TRAFFIC_DIR, OPENAI_TRAFFIC_SEQ, GEMINI_TRAFFIC_DIR, GEMINI_TRAFFIC_SEQ
• Container: CONTAINER_PACKAGES, LOCALAPPDATA, TEMP, TMP, TMPDIR
• Agent: AGENTS_BASE_DIR, AGENTS_CWD, AGENTS_INSTANCE_ID, AGENTS_REPO_URL
• Misc: MCP, MCP_FILE, INIT_TOOLS, INVOKED_AGENT_NAME, PARENT_MESSAGES_DIR

9.3 PAT Masking

File: scorpiox-unshare.c, line 2410–2424

The --pat argument value is partially masked in log output (first 3 chars shown, rest replaced). ✅ Good practice, though incomplete (should mask entirely).

---

10. Data Retention

10.1 Session Cleanup

• Configurable via SESSION_RETENTION_DAYS (default: 7 days)
• sx_session_cleanup_old() deletes sessions older than retention period
• Called during normal operation

10.2 Unmanaged Data Retention

The following data has no automated cleanup:

---

11. Risk Assessment

Critical Findings

Positive Findings

---

12. Recommendations Summary

Immediate (P0)

Remove all hardcoded secrets from sx_config_embedded.c — rotate all exposed keys immediately

Upgrade password hashing from SHA256 to Argon2id with per-user random salt

Add TLS to the TCP token fetch path

Short-term (P1)

Restrict config file permissions to 0600 (owner-only read/write)

Redact sensitive keys from config-snapshot.txt before writing

Use mkstemp() for all temporary file creation

Add key redaction to OpenAI traffic URL logging

Medium-term (P2)

Implement encrypted storage for config secrets (OS keychain integration or file encryption)

Add log rotation for email server and DNS audit logs

Add automated cleanup for conversation files and traffic captures

Anonymize telemetry data (hash hostname/username before sending)

---

End of Data Handling Audit Report