Data Handling, File I/O, Privacy & Encryption Audit

Audit Date: 2026-04-28 Codebase: scorpiox/clang Scope: 222 source files (124,371 LOC), excluding vendor libraries Auditor: Security Audit Agent

---

Executive Summary

The scorpiox codebase has a broad data handling footprint spanning configuration management, conversation persistence, multi-provider API credential handling, email services with TLS/DKIM, traffic capture, and session logging. Three critical findings were identified: (1) hardcoded API keys compiled into the WASM binary, (2) unsalted SHA-256 password hashing for email authentication, and (3) predictable temporary file paths creating symlink attack surfaces. The codebase demonstrates good practices in some areas (TLS via mbedTLS, redacted API key logging, session data isolation) but has significant gaps in credential management and temporary file security.

Overall Risk Rating: HIGH

---

1. Data Flow Summary

┌──────────────────────────────────────────────────────────────────────┐
│                        DATA FLOW DIAGRAM                             │
├──────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  User Input ──► sx.c (TUI) ──► Provider (API) ──► AI Response       │
│       │              │              │                    │            │
│       ▼              ▼              ▼                    ▼            │
│  Bash exec      Conversation   HTTP Request         Display          │
│  (sx_exec)      .json save     (credentials)       (sxui_*)         │
│       │              │              │                    │            │
│       ▼              ▼              ▼                    ▼            │
│  /tmp files     .scorpiox/     Traffic capture     Session log       │
│                 sessions/      .scorpiox/traffics/  events.jsonl     │
│                                                                      │
│  Config cascade:                                                     │
│  defaults → exe_dir/scorpiox-env.txt → ~/.claude/scorpiox-env.txt   │
│           → CWD/.scorpiox/scorpiox-env.txt                          │
│                                                                      │
│  Email subsystem:                                                    │
│  SMTP/IMAP ──► sxmail_auth (SHA256) ──► maildir storage            │
│            ──► TLS (mbedTLS)        ──► DKIM (RSA-SHA256)          │
└──────────────────────────────────────────────────────────────────────┘

---

2. File I/O Inventory

2.1 Configuration Files

2.2 Session & Conversation Storage

2.3 Temporary Files

2.4 Email Subsystem Files

2.5 Logging Destinations

---

3. PII Assessment

3.1 PII Data Handled

3.2 PII Logging Risks

• scorpiox-agent.c:817 — Logs environment variable key=value pairs at INFO level: SX_INFO(" [VAR] %s=%s", key, value). If sensitive variables (API keys, tokens) are set, they will appear in logs.
• scorpiox-server.c:502 — Logs authenticated user_id and email from JWT claims at INFO level.
• config-snapshot.txt — Written at session start, contains full config dump including API keys.

---

4. Credential Management

4.1 Credential Types & Storage

4.2 Critical Finding: Hardcoded Secrets in WASM Binary

File: libsxutil/sx_config_embedded.c (auto-generated, compiled into WASM)

{"ANTHROPIC_ANTIGRAVITY_KEY", "sk-6088a10dc3c1473cac567069b0e557f6"},
{"ANTHROPIC_ZAI_KEY", "9c6fba5db3f84613aaf8700b05990835.ue19jY48d9GmddqX"},
{"GEMINI_API_KEY", "AIzaSyDsvlLnCdMFXnlCLxurMaAO5RKI8IQHVA8"},
{"CLAUDE_CODE_SSH_PASS", "xboxone"},

These secrets are baked into the compiled binary and can be trivially extracted. The WASM binary is distributed to end users, making this a secret exposure vulnerability.

4.3 Credential Logging Practices

Good: API keys are redacted in log output:

• sx_provider_openai.c:452 — Logs key=(set) or key=(none) instead of actual value
• sx_provider_openai_wasm.c:659 — Logs key=* instead of actual value
• sx_provider_anthropic.c:127 — Logs key=* for API key presence

Bad:

• scorpiox-agent.c:817 — SX_INFO(" [VAR] %s=%s", key, value) logs all environment variables including potentially sensitive ones without filtering
• sx_config.c:640 — SX_INFO("config: wrote %s=%s to %s", key, value, path) logs config writes including API key values

4.4 Credential Flow

scorpiox-env.txt ──► sx_config_init() ──► in-memory g_cfg struct
     │                                        │
     ▼                                        ▼
Environment vars ──► getenv() ──────────► Provider data->api_key[256]
                                              │
                                              ▼
                                         setenv() before exec
                                         (child process inherits)
                                              │
                                              ▼
                                         HTTP headers:
                                         "x-api-key: <key>"
                                         "Authorization: Bearer <key>"

---

5. Encryption Usage

5.1 Cryptographic Operations

5.2 Critical Finding: Unsalted SHA-256 Password Hashing

File: sxmail_auth.c:121-130

int sxmail_auth_hash_password(const char pass, char out, size_t out_sz) {
    if (!pass || !out || out_sz < 65) return -1;
    unsigned char digest[32];
    mbedtls_sha256((const unsigned char *)pass, strlen(pass), digest, 0);
    for (int i = 0; i < 32; i++)
        snprintf(out + i * 2, 3, "%02x", digest[i]);
    out[64] = '\0';
    return 0;
}

Issues:

No salt — identical passwords produce identical hashes, enabling rainbow table attacks

No iteration/stretching — single SHA-256 pass, trivially brute-forced (~billions/sec on GPU)

Should use bcrypt, scrypt, or Argon2id with per-user salt and adequate work factor

5.3 TLS Configuration

The TLS implementation in sxmail_tls.c uses mbedTLS correctly:

• Proper entropy seeding via mbedtls_ctr_drbg_seed()
• Certificate chain loading via mbedtls_x509_crt_parse_file()
• Private key loading via mbedtls_pk_parse_keyfile()
• SSL session cache enabled
• Custom BIO callbacks for non-blocking I/O with handshake timeout protection

5.4 Data at Rest Encryption

No data at rest encryption is implemented. All persistent data is stored in plaintext:

• Conversation JSON files
• Session logs
• Config files with API keys
• Email messages in maildir
• Traffic captures (full HTTP bodies)

---

6. Temporary File Security

6.1 Findings

6.2 Specific Vulnerabilities

Symlink attack vectors:

• /tmp/sx_voice.wav and /tmp/sx_voice_result.txt — Fixed paths, no O_EXCL, no ownership check
• /tmp/sx_post__.txt — Predictable (PID + timestamp), could be pre-created as symlink
• /tmp/sx_mcp_.json — PID-predictable
• /tmp/sx_builtin_.sh — Name-predictable and executed as shell script

Positive:

• /tmp/sxmux/ directory created with mkdir(..., 0700) — restricts access to owner
• scorpiox-vault-git.c properly uses mkdtemp() for temp directory

6.3 Temp File Cleanup

• sx.c:707 — remove(tmpfile) after editor use ✓
• sxmail_maildir.c — Cleans up failed deliveries with remove()/unlink() ✓
• sxmux_session.c — Cleans up stale sockets and PID files ✓
• Voice files: No cleanup observed for /tmp/sx_voice.wav ⚠
• Server POST files: No cleanup observed for /tmp/sx_post_* ⚠

---

7. Logging Analysis

7.1 Logging Infrastructure

• Framework: Custom sx_log.c with 5 levels: ERROR, WARN, INFO, DEBUG, TRACE
• Output: Configurable file (sx_log_set_file()) or stderr
• Timestamps: Millisecond precision [HH:MM:SS.mmm]
• Source location: Included for DEBUG/TRACE (file:line)
• Volume: 1,342+ log statements across the codebase

7.2 Sensitive Data in Logs

7.3 Log File Locations

---

8. Data Retention

8.1 Persistence Model

8.2 Observations

• SESSION_RETENTION_DAYS config key exists (default: 7) but no automatic cleanup code was found that enforces it
• .scorpiox/sessions/ is automatically added to .gitignore ✓
• No data minimization — full conversation history, tool inputs/outputs, and trace data are retained
• Traffic capture (scorpiox-traffic.c) can be manually cleared via --clear flag which runs rm -rf .scorpiox/traffics

---

9. Environment Variable Usage

9.1 Sensitive Environment Variables (133 getenv() calls)

9.2 Environment Variable Injection

• scorpiox-agent.c reads environment variables from a file and calls setenv() for each — this could be used to inject arbitrary env vars into child processes
• Multiple providers call setenv() to pass API keys to child processes (e.g., scorpiox-openai binary)
• Git PAT tokens are injected into URLs: https://PAT@host/path — may appear in process listings

---

10. Risk Assessment

10.1 Critical Risks

10.2 High Risks

10.3 Medium Risks

10.4 Low Risks

---

11. Recommendations Summary

Immediate Actions (Critical)

Rotate all hardcoded credentials in sx_config_embedded.c — they are compromised

Remove secrets from compiled binaries — use runtime configuration or encrypted config vault

Replace SHA-256 password hashing with Argon2id (preferred) or bcrypt with salt

Short-term Actions (High)

Add sensitive-key filtering to all log output (match patterns: KEY, PASS, SECRET, TOKEN)

Redact sensitive values in config-snapshot.txt

Implement data-at-rest encryption for conversation and session data

Medium-term Actions

Replace all predictable /tmp/sx_* paths with mkstemp()/mkdtemp()

Implement automatic session data cleanup per SESSION_RETENTION_DAYS

Add content filtering/redaction for tool outputs in conversation storage

Use OS keychain (macOS Keychain, Linux Secret Service) for API key storage

---

Report generated by Security Audit Agent — 2026-04-28