Data Handling, File I/O, Privacy & Encryption Audit

Audit Date: 2026-04-28 Codebase: scorpiox/clang Scope: 222 source files (142,256 LOC excluding vendor code), plus vendored mbedTLS and yyjson Auditor: Security Audit Agent

---

1. Data Flow Summary

The scorpiox codebase is a multi-component C application comprising:

Data flow path:

User Input → sx TUI → libsxnet (API provider) → HTTP/TLS → Remote API
                  ↓
         .scorpiox/sessions/<id>/  (conversations, traffic, logs, config snapshots)
         .scorpiox/conversations/  (persistent conversation JSON)
         .scorpiox/traces/         (debug trace JSONL)

---

2. File I/O Inventory

2.1 Configuration Files (Read)

Config cascade: Built-in defaults → exe_dir config → CWD project config

2.2 Session Data (Read/Write)

2.3 Conversation Persistence (Read/Write)

2.4 Email Server Files

2.5 HTTP Server Temporary Files

2.6 Socket/PID Files (sxmux)

Socket directory created with mkdir(..., 0700) — ✅ Correct permissions.

2.7 WhatsApp Auth Data

---

3. PII Assessment

3.1 Directly Handled PII

3.2 Indirect PII Exposure

• Session traffic files (.scorpiox/sessions//traffic/) contain raw API request/response bodies, which may include any user-submitted content
• Conversation JSON files persist all user messages including potentially sensitive content
• Trace JSONL files record API payloads at multiple checkpoints (API_REQUEST, API_RESPONSE, TOOL_USE_ADD)

3.3 PII Mitigation

• ✅ Sessions stored under .scorpiox/sessions/ which is auto-added to .gitignore
• ✅ Session retention cleanup via sx_session_cleanup_old() with configurable SESSION_RETENTION_DAYS
• ⚠️ No encryption of data at rest for session/conversation files
• ⚠️ Conversation files in .scorpiox/conversations/ are NOT auto-added to .gitignore

---

4. Credential Management

4.1 Built-in Default Credentials

FINDING — MEDIUM RISK: The config defaults table in sx_config.c contains:

4.2 Config File Credential Storage

Credentials are stored in plaintext scorpiox-env.txt files as KEY=VALUE pairs. Sensitive keys include:

• ANTHROPIC_API_KEY, ANTHROPIC_ANTIGRAVITY_KEY, ANTHROPIC_ZAI_KEY
• GEMINI_API_KEY, OPENAI_API_KEY
• CODEX_SSH_PASS, CLAUDE_CODE_SSH_PASS
• SERVER_JWT_SECRET
• HTTP_RELAY_KEY, FETCHTOKEN_API_KEY
• SMTP_PASS, EMAIL_RELAY_PASS

FINDING — HIGH RISK: All credentials stored as plaintext in config files. No encryption, no OS keychain integration, no vault support.

4.3 Credential Redaction

✅ GOOD: sx_config_is_sensitive() correctly identifies sensitive keys by checking for substrings: KEY, PASS, SECRET, TOKEN, CREDENTIAL (case-insensitive).

✅ GOOD: Config snapshot in session files redacts sensitive values to **.

✅ GOOD: Startup logging masks keys containing "KEY" as *.

⚠️ GAP: Logging only masks keys matching strstr(keys[k], "KEY") — this misses _PASS and _SECRET keys in the startup log (though snapshot_write_entry uses the comprehensive sx_config_is_sensitive()).

4.4 Runtime Credential Handling

4.5 Token Proxy Security

scorpiox-server-fetchtoken:

• API key comparison uses strcmp() — ⚠️ Not constant-time (timing side-channel possible)
• API key logged as * — ✅ Good
• Key comes from config, not hardcoded — ✅ Good

---

5. Encryption Usage

5.1 In-Transit Encryption

5.2 Crypto Primitives Used

5.3 Encryption at Rest

FINDING — HIGH RISK: No encryption at rest is used anywhere in the codebase. All persistent data (conversations, sessions, config files, email maildir, WhatsApp credentials) is stored in plaintext on the filesystem.

5.4 mbedTLS Configuration

sx_mbedtls_config.h enables:

• AES-128-CFB (cipher mode)
• PBKDF2 (via PKCS5)
• TLS 1.2 (client + server)
• RSA, X.509 certificates
• SHA-1, SHA-256, SHA-384, SHA-512
• CTR-DRBG entropy

Note: TLS 1.3 is NOT enabled. Only TLS 1.2 is configured.

---

6. Temporary File Security

6.1 POST Body Temp Files (scorpiox-server)

// Linux path construction:
snprintf(tmppath, sizeof(tmppath), "/tmp/sx_post_%d_%ld.txt",
         sx_getpid(), (long long)time(NULL));

FINDINGS:

• ⚠️ Predictable filenames — uses PID + timestamp, which are guessable → symlink attack risk
• ⚠️ No mkstemp() — uses fopen() with constructed path instead of secure temp file creation
• ✅ Files are cleaned up via unlink() after use
• ⚠️ Race condition — gap between name construction and fopen() allows TOCTOU attack

6.2 Other Temporary Usage

• sxmux_session.c creates socket directory with mkdir(..., 0700) — ✅ Correct permissions
• No other temporary file creation patterns found outside of vendor code

---

7. Logging Analysis

7.1 Log Architecture

• File logging: Session logs to .scorpiox/sessions//session.log
• Stderr logging: Fallback when file logging fails
• Log levels: ERROR, WARN, INFO, DEBUG, TRACE (configurable via LOG_LEVEL)
• Timestamps: Millisecond precision [HH:MM:SS.mmm]

7.2 Sensitive Data in Logs

7.3 Trace System

The trace system (sx_trace.c) writes detailed data flow checkpoints to .scorpiox/traces/.jsonl and/or .scorpiox/sessions//trace.jsonl:

• API_REQUEST — full request being sent
• API_RESPONSE — full response received
• TOOL_USE_ADD — tool call details
• CONV_SAVE / CONV_LOAD — conversation state

FINDING — HIGH RISK: Trace data may contain API keys in HTTP headers and full conversation content. Trace files have no special access controls.

7.4 Log File Locations

---

8. Environment Variable Usage

8.1 Environment Variables Read

8.2 Environment Variables Set (for child processes)

8.3 Config System vs Environment

The codebase uses its own sx_config_get() system rather than raw getenv() for most configuration. The config cascade (defaults → file → file) avoids polluting the process environment with secrets. This is a good pattern.

Exception: scorpiox-sshpass passes password via write() to PTY (not env var), which is better than SSHPASS env var but the password is still visible in /proc//cmdline via the -p argument.

---

9. Data Retention

9.1 Session Retention

• Configurable via SESSION_RETENTION_DAYS config key
• sx_session_cleanup_old() purges sessions older than the retention period
• Default: not set (sessions persist indefinitely)
• Cleanup triggers: at session creation time

9.2 Conversation Retention

• No automatic cleanup mechanism found for .scorpiox/conversations/ files
• Conversations persist indefinitely

9.3 Email Retention

• Maildir-based storage with no automatic expiration found in audited code
• Queue messages persist until relay delivery

9.4 Trace/Log Retention

• No automatic cleanup for trace files or log files independent of session cleanup
• If session is deleted, associated logs/traces are removed

---

10. Risk Assessment

Critical Risks

High Risks

Medium Risks

Positive Findings

---

11. Recommendations

Replace unsalted SHA-256 password hashing with Argon2id or bcrypt (C-2)

Use mkstemp() for temp files instead of predictable name construction (H-7)

Increase PBKDF2 iterations from 64 to at least 100,000 (H-5)

Add encryption at rest for session/conversation data or at minimum restrict file permissions to 0600 (C-3)

Use environment variable or stdin for scorpiox-sshpass password instead of CLI -p (C-1)

Add constant-time comparison for fetchtoken API key validation (M-2)

Extend startup log masking to cover _PASS and _SECRET patterns (M-3)

Enable TLS 1.3 in mbedTLS configuration (M-4)

Add encryption to scorpiox-beam file transfers (M-5)

Add conversation cleanup mechanism similar to session retention (M-8)

Remove hardcoded internal IP from config defaults (M-1)

Consider redacting Authorization headers in traffic/trace files (H-3, H-4)