Third-Party Software Security Review — ScorpioX Code

Software: ScorpioX Code Type: AI-Powered Development Tool / CLI Platform Language: Pure C (zero external dependencies) Audit Date: 2026-04-28 Codebase Commit: 9bfa5b461aa008cd7a1713d37c9aa6c44cecc4ce Classification: CONFIDENTIAL — For Corporate Review Only

---

1. Executive Summary

This report presents a comprehensive security audit of ScorpioX Code, an AI-powered development tool and CLI platform written in pure C. The audit was performed by 13 specialized automated agents, each analyzing a distinct security domain across 378,558 total lines of code (151,487 project code, 226,685 vendor code).

Overall Risk Rating: HIGH

The software demonstrates exceptional discipline in several areas — notably zero uses of unsafe string functions (strcpy, strcat, gets, scanf), a safe-to-unsafe function ratio exceeding 2,800:1, all telemetry disabled by default, and comprehensive use of bounded buffer operations. However, significant risks persist in TLS certificate verification (systematically disabled across token fetchers and email), command injection vectors in network-reachable code paths, a complete absence of cryptographic integrity verification for binary distribution, and sensitive data exposure through log files.

Aggregate Findings

Windows-Filtered Findings (excluding Linux/macOS-only): 11 Critical, 28 High, 118 Medium, 28 Low — 185 actionable findings.

Key Strengths

• Zero external package manager dependencies (core build)
• All third-party code vendored in-tree with known versions
• Fully static linking eliminates runtime dependency attacks
• No tracking or telemetry by default — all opt-in
• Exceptional buffer safety: 2,213 snprintf calls, 0 strcpy/strcat/sprintf in project code
• Strong Windows deployment posture (LOW risk per Windows-specific audit)

Critical Concerns

No cryptographic verification of distributed binaries (no checksums, signatures, or code signing)

SSL certificate verification disabled in token fetchers and email module (MITM risk)

Command injection vectors in network-reachable server code (Windows CGI path)

Sensitive data logged to disk including API keys in HTTP headers and VTRACE config dumps

Outdated vendored mbedTLS (3.6.3 vs 3.6.6) with 11 unpatched security advisories

---

2. Deployment Scope — Windows Workstation

Primary Deployment: Windows Workstation

The following binaries are compiled and deployed on Windows:

Total Windows binaries: ~58 executables + 1 DLL

Linux-Only Binaries (Not Deployed on Windows)

macOS-Only Binaries

Windows-Filtered Risk Summary

After excluding Linux-only and macOS-only findings:

---

3. Changes Since Last Audit

Previous Audit: output/2026-04-28_4d61a6a (commit 4d61a6a) Previous Agents: 11 (supply-chain through windows-deployment) Current Agents: 13 (added telemetry-tracking, install-script)

Severity Comparison

Key Changes

New: Telemetry & Tracking Audit — Confirmed all telemetry disabled by default (LOW risk)

New: Install Script Audit — Uncovered 4 CRITICAL findings in binary distribution pipeline

Memory Safety — Deeper analysis now tracks 291 INFO-level dangling pointer risks and 82 MEDIUM error-path memory leaks

Codebase Size — Reduced from 398,610 to 378,558 total lines (cleanup of duplicate/plan files)

---

4. Supply Chain & Dependencies

Agent Risk Rating: MEDIUM

Key Findings

Recommendations

• Update mbedTLS to 3.6.6 — addresses buffer overflow, TLS 1.3 client impersonation, ECDSA stack overflow
• Remove pre-built binaries from source tree; build from source in CI
• Pin npm dependency to stable release

---

5. Build System & Code Provenance

Agent Risk Rating: LOW

Key Findings

Hardening Flags Summary

---

6. Network Endpoints

Agent Risk Rating: HIGH

Key Findings

Network Inventory Summary

• 49 unique hardcoded URLs across source code
• 15+ unique hardcoded IP addresses
• 12 hardcoded ports
• 9+ unique domain names

Recommendations

• Migrate all http:// token endpoints to https://
• Remove hardcoded private IPs from compiled defaults
• Use DNS hostnames instead of IP addresses for infrastructure references
• Implement configurable endpoint registry

---

7. TLS/SSL Security

Agent Risk Rating: HIGH

Key Findings

TLS Verification Status by Module

Recommendations

• Enable certificate verification in ALL token fetchers (set CURLOPT_SSL_VERIFYPEER=1L, CURLOPT_SSL_VERIFYHOST=2L)
• Add runtime flag for development self-signed cert bypass instead of unconditional disable
• Migrate all HTTP token endpoints to HTTPS
• Update mbedTLS to 3.6.6

---

8. Hardcoded Credentials

Agent Risk Rating: LOW

Key Findings

Positive Patterns

• Configuration cascade design: environment variables → config files → compiled defaults
• Sensitive field redaction function exists and covers all credential keys
• No real API keys, passwords, or tokens found in source code

Recommendations

• Replace "xxx" placeholder with empty string "" for OPENAI_API_KEY
• Remove _PASS fields from compiled defaults entirely
• Move infrastructure IPs to runtime-only configuration

---

9. File I/O & Data Handling

Agent Risk Rating: HIGH

Key Findings

Positive Patterns

• mkstemp() used in 11 locations (inconsistent application)
• realpath() used for path traversal validation in some modules
• Config redaction function exists for log output

Recommendations

• Redact x-api-key and Authorization headers before logging
• Apply sx_config_is_sensitive() to VTRACE logging
• Set all log and session file permissions to 0600
• Replace ALL predictable temp file patterns with mkstemp()/mkdtemp()

---

10. Buffer Safety

Agent Risk Rating: LOW

Key Findings

Exceptional Metrics

---

11. Memory Safety

Agent Risk Rating: HIGH

Key Findings

Analysis Summary

Recommendations

• Add NULL checks after all 5 calloc() calls in sx.c
• Use temporary variable for realloc() in sx_mcp.c
• Prioritize error-path leak fixes in network-facing modules
• Consider adopting a FREE_AND_NULL() macro project-wide

---

12. Command Injection

Agent Risk Rating: CRITICAL

Key Findings

System Call Inventory

Windows-Critical: C2 (CVSS 9.8)

The scorpiox-server.c Windows CGI path uses _popen() with unsanitized QUERY_STRING and PATH_INFO from HTTP requests. An attacker can break out of the set "..." command on Windows to execute arbitrary commands remotely. This is the highest-severity finding in the entire audit.

Recommendations

• Immediate: Sanitize QUERY_STRING and PATH_INFO in scorpiox-server.c using SX_SANITIZE_CMD (already applied to other variables in the same function)
• Replace system() with fork()+execvp() (or CreateProcessW on Windows) wherever possible
• Implement and enforce is_safe_shell_arg() validation for all user-supplied shell arguments

---

13. Privilege & Access Control

Agent Risk Rating: MEDIUM

Key Findings

Windows-Relevant Privilege Findings

After excluding Linux-only findings (unshare, sshpass, podman, cron):

• 0 Critical (the unshare --privileged finding is Linux-only)
• 3 High (WSL chroot, server bind 0.0.0.0, DNS port 53)
• 3 Medium (no rate limiting, JWT hardcoded, SMTP creds)

Positive Patterns

• Main sx binary runs entirely as unprivileged user
• No setuid/setgid calls in any Windows binary
• No capability manipulation on Windows
• Process monitoring subsystem tracks child process lifecycle

---

14. Windows Deployment Analysis

Agent Risk Rating: LOW

Key Findings

Windows-Specific Security Posture

Assessment

The Windows deployment profile is clean. The software operates as an unprivileged CLI application with no system-level modifications. The primary risk on Windows is the unsigned binary distribution (may trigger SmartScreen warnings) and the CGI command injection in scorpiox-server.c (covered in Section 12).

---

15. Telemetry and Tracking

Agent Risk Rating: LOW

Key Findings

Telemetry Configuration Defaults

Assessment

Excellent privacy posture. No tracking by default, no mandatory data collection, full user control over all telemetry features. The session telemetry feature (which sends conversation content) is appropriately documented as sensitive and disabled by default.

---

16. Install Script & Distribution Security

Agent Risk Rating: CRITICAL

Key Findings

Recommendations (Priority Order)

Implement SHA-256 checksum verification for all binary downloads (publish checksums alongside binaries)

Implement code signing (Authenticode for Windows, GPG for Linux)

Remove curl -k from all download paths

Remove hardcoded NAS credentials from source code

Implement binary hash verification in self-update mechanism

Add reproducible build pipeline with provenance attestation

---

17. Consolidated Risk Matrix

---

18. Conclusion & Recommendations

Overall Assessment

ScorpioX Code is a well-engineered C application with exceptional buffer safety discipline and a privacy-respecting telemetry model. The codebase demonstrates strong secure coding practices in its core string handling, with zero uses of unsafe functions across 151K lines of project code. The Windows deployment posture is clean, with no system-level modifications, no privilege escalation, and safe process spawning patterns.

However, the software has systemic TLS/SSL verification weaknesses that undermine transport security across multiple modules, a complete absence of cryptographic integrity verification in its binary distribution pipeline, and critical command injection vectors in network-reachable code paths.

Priority Remediation Roadmap

Immediate (Critical — Before Deployment)

Fix CGI command injection in scorpiox-server.c — apply SX_SANITIZE_CMD to QUERY_STRING and PATH_INFO

Enable SSL certificate verification in all token fetchers and email module

Migrate token endpoints from HTTP to HTTPS

Implement binary checksum verification (SHA-256) for all download paths

Remove hardcoded NAS/SMB credentials from source code

Short-Term (High — Within 30 Days)

Update vendored mbedTLS from 3.6.3 to 3.6.6

Set log and session file permissions to 0600

Replace predictable temp file patterns with mkstemp()/mkdtemp()

Add NULL checks after all allocation calls in sx.c

Implement code signing (Authenticode for Windows .exe)

Medium-Term (Medium — Within 90 Days)

Implement reproducible build pipeline with provenance attestation

Address 82 error-path memory leak locations

Clamp snprintf return values before passing to send_all()

Replace system() calls with execvp()/CreateProcessW where feasible

Default server bindings to 127.0.0.1 instead of 0.0.0.0

Risk Acceptance Note

For Windows workstation deployment, the software's risk profile is manageable. The Linux-only findings (rootless container runtime, unshare privileged mode) do not apply. The Windows-specific risk is dominated by the CGI command injection in scorpiox-server.c (CVSS 9.8) — this should be the top-priority fix. All other Windows findings are HIGH or lower.

---

19. Appendix: Audit Methodology

Agents Deployed

Scope

• In scope: All project source code (151,487 lines across ~223 C/H files)
• Partial scope: Vendored libraries (mbedTLS, yyjson) — version and configuration analysis only
• Out of scope: Third-party system libraries (libcurl, OpenSSL, zlib), runtime behavior testing, penetration testing

Severity Definitions