Third-Party Software Security Review — SCORPIOX CODE

---

1. Executive Summary

This report presents the consolidated findings from a comprehensive security audit of SCORPIOX CODE, an AI-powered development CLI platform written in pure C. The audit was conducted by 13 specialized automated agents, each targeting a distinct security domain, against codebase commit 5af0d64.

Key Metrics

Overall Risk Rating: LOW-MEDIUM

The software demonstrates a mature security posture for a C codebase of this scale. Notable strengths include:

• Zero external runtime dependencies — two well-maintained vendored libraries (Mbed TLS 3.6.6, yyjson 0.12.0), both at current versions
• 99.93% safe string operations — 2,853 safe (snprintf/strncpy) vs. 2 unsafe (sprintf) calls
• No hardcoded credentials — all API keys are empty placeholders populated at runtime
• All telemetry disabled by default — no phone-home, no auto-update, no mandatory data collection
• Systematic command injection hardening — fork()+execvp() with argv arrays on Unix; validated shell commands on Windows
• Full RELRO, stack protector, and FORTIFY_SOURCE enabled in build system

Key areas requiring attention:

Install/distribution security (3 HIGH) — SHA256 verification is soft-fail, no code signing, single point of compromise for binary distribution

Buffer safety in server code (2 HIGH) — unclamped snprintf return values in CGI/SSE header accumulation can cause stack buffer overflow

Memory safety in network code (2 HIGH) — unbounded allocation sizes from network-derived data in HTTP relay

Network endpoint hardcoding (1 HIGH) — hardcoded public IP address for TCP relay host

Command injection on Windows (1 HIGH) — network-reachable OTP handler uses shell-interpolated strings

File I/O (1 HIGH) — Gemini API key exposed in URL query parameters

Windows Deployment Assessment

For the Windows workstation deployment scope (12 primary binaries), the filtered risk is LOW. Most HIGH findings relate to server-side or Linux-only components. The Windows-specific surface shows:

---

2. Deployment Scope

2.1 Windows Workstation (Primary Deployment Target)

The following binaries are compiled for and deployed on Windows workstations:

Core Windows Binaries (12 Primary)

Additional Windows-Compiled Binaries (42)

The full Windows build produces 52 binaries + 1 DLL (libsx.dll), including AI provider proxies (scorpiox-gemini, scorpiox-openai), token management tools, server components, and utility binaries. See Section 14 for the complete inventory.

2.2 Linux-Only Binaries (Not Deployed on Windows)

2.3 macOS-Only Binaries

2.4 Windows-Filtered Findings

Of the 175 total findings, 58 are relevant to Windows workstation deployment. Many HIGH/MEDIUM findings (particularly in privilege/access control, container security, and Linux-specific file I/O) apply only to Linux server deployments and do not affect Windows workstation users.

---

3. Changes Since Last Audit

The previous audit was conducted on 2026-04-29 against commit 3ad7dfc (folder: output/2026-04-29_3ad7dfc).

Delta Summary

Windows-Specific Delta

Key Improvements Since Last Audit

All critical findings resolved — previous audit had 2 critical issues; current audit has 0

Total findings reduced by 39% (286 → 175) — significant remediation effort

Codebase grew by 23,186 lines (381,273 → 404,459) — net increase in code with fewer findings indicates improved security practices

Medium findings reduced by 61% (100 → 39) — bulk of remediation targeted medium-severity issues

Areas of Concern

• Windows HIGH findings increased from 5 to 10 — this is attributable to more granular audit coverage in the current cycle (new install-script and buffer-safety findings now correctly scoped to Windows), not regression

---

4. Supply Chain & Dependencies

Agent: supply-chain | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 0 Low, 5 Info

Architecture

The project has a minimal supply chain footprint:

• Core: Pure C with zero runtime package manager dependencies
• Vendored Libraries: 2 (source-only, no pre-compiled binaries)
• Build System: CMake 3.16+ (no FetchContent or ExternalProject)
• No pre-built binaries committed to the repository

Vendored Libraries

Package Managers

Build-Time External Fetches

Assessment

The supply chain is well-controlled. The vendored-source approach eliminates most supply chain attack vectors. The npm dependency tree in the WhatsApp bridge component (~105 transitive packages) is the largest external surface area but is isolated from the core C codebase.

---

5. Build System & Code Provenance

Agent: build-provenance | Risk: LOW | Findings: 0 Critical, 0 High, 2 Medium, 3 Low, 5 Info

Security Compiler Flags

Findings

---

6. Network Endpoints

Agent: network-endpoints | Risk: MEDIUM | Findings: 0 Critical, 1 High, 7 Medium, 8 Low, 34 Info

Summary

The codebase contains hardcoded network endpoints spanning AI provider APIs, first-party infrastructure, third-party search engines, and DNS resolvers. All external-facing endpoints use HTTPS — good baseline security posture.

High-Severity Finding

Medium-Severity Findings

First-Party Infrastructure Endpoints (All HTTPS)

Third-Party AI Provider Endpoints

---

7. TLS/SSL Security

Agent: tls-security | Risk: MEDIUM | Findings: 0 Critical, 0 High, 4 Medium, 2 Low, 3 Info

Architecture

A centralized sx_curl_set_tls() helper applies consistent TLS settings across all 9 curl callsites. TLS 1.2 is enforced as minimum protocol version in all mbedTLS usage.

Findings

Mitigations

• SX_TLS_VERIFY defaults to true with warning when disabled
• Traffic capture tool is Linux-only, user-initiated, and explicitly an MITM proxy
• HTTP relay is disabled by default (HTTP_RELAY=0)

---

8. Hardcoded Credentials

Agent: credential-hardcode | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 0 Low, 4 Info

Result: No Credentials Found ✅

All credential fields (11 API keys, passwords, and secrets in the embedded configuration) are empty placeholder strings (""). Credentials are supplied at runtime via:

• Environment variables
• Config file overrides (scorpiox-env.txt)
• External token-fetching mechanisms (SSH, HTTP, TCP)

Informational Findings

---

9. File I/O & Data Handling

Agent: file-io | Risk: LOW-MEDIUM | Findings: 0 Critical, 1 High, 5 Medium, 5 Low, 5 Info

Positive Controls

• Prior O_CLOEXEC hardening pass completed (all raw open() calls)
• Config files with API keys written with 0600 permissions
• Sensitive headers redacted in traffic logs
• All temp files use mkstemp()/mkdtemp() — no tmpnam()/tempnam()

Findings

---

10. Buffer Safety

Agent: buffer-safety | Risk: MEDIUM | Findings: 0 Critical, 2 High, 2 Medium, 2 Low, 4 Info

Safe-to-Unsafe Ratio: 99.93%

Findings

Recommended Fix for F-01 and F-02

if (w > 0) {
    sse_extra_pos += w;
    if ((size_t)sse_extra_pos >= sizeof(sse_extra))
        sse_extra_pos = (int)(sizeof(sse_extra) - 1);
}

This pattern is already correctly used at line 1394 in the same file — suggesting a copy-paste oversight in the streaming paths.

---

11. Memory Safety

Agent: memory-safety | Risk: LOW-MEDIUM | Findings: 0 Critical, 2 High, 6 Medium, 4 Low, 3 Info

Defensive Patterns

• sx_strdup() wrapper aborts on OOM
• realloc() patterns consistently use temporary variables (no pointer loss)
• ~504 allocation sites, ~1,370 free sites analyzed

Findings

---

12. Command Injection

Agent: command-injection | Risk: MEDIUM | Findings: 0 Critical, 1 High, 4 Medium, 10 Low, 1 Info

Architecture

The codebase shows systematic command injection hardening (documented CJ-01 through CJ-13 fixes). On Unix, virtually all code paths use fork()+execvp() with argv arrays. Residual risks are primarily Windows-specific system()/popen() fallbacks.

Findings

Windows-Specific Note

9 of 16 command injection findings are Windows-only, using system() or _popen() where Linux uses fork()+execvp(). All Windows paths include input validation (is_safe_shell_arg() allowlist). The highest-risk item (CJ-01) has strict isalnum + @._- character validation on HTTP parameters.

---

13. Privilege & Access Control

Agent: privilege-access | Risk: MEDIUM | Findings: 0 Critical, 2 High, 4 Medium, 2 Low, 5 Info

Architecture

The project produces no setuid/setgid binaries. Privilege-sensitive operations are concentrated in the Linux container runtime (scorpiox-unshare) and VM runner (scorpiox-vm), neither of which are deployed on Windows.

Findings

Windows Deployment Impact

All privilege/access findings are Linux-only. The Windows deployment has no privilege escalation mechanisms, no service installation, no registry manipulation, and no elevation-of-privilege code paths.

---

14. Windows Deployment Analysis

Agent: windows-deployment | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 3 Low, 4 Info

Windows Build Configuration

• Compiler: MinGW GCC (WinLibs POSIX UCRT)
• Linking: Static (-static)
• System Libraries: ws2_32, wldap32, crypt32, advapi32, bcrypt, secur32, iphlpapi
• TLS: Vendored mbedTLS + system OpenSSL via curl

Complete Windows Binary Inventory (52 + 1 DLL)

Windows-Only: scorpiox-wsl, scorpiox-busybox Cross-Platform (50): sx, scorpiox-agent, scorpiox-askuserquestion, scorpiox-bash, scorpiox-beam, scorpiox-claudecode-fetchtoken, scorpiox-claudecode-models, scorpiox-claudecode-refreshtoken, scorpiox-codex-fetchtoken, scorpiox-codex-refreshtoken, scorpiox-config, scorpiox-conv, scorpiox-debug, scorpiox-dns, scorpiox-email, scorpiox-emit-session, scorpiox-fetch, scorpiox-frp, scorpiox-gemini, scorpiox-gemini-fetchtoken, scorpiox-hook, scorpiox-host, scorpiox-kql, scorpiox-logger, scorpiox-mcp, scorpiox-mirror-git, scorpiox-multiplexer, scorpiox-openai, scorpiox-otp, scorpiox-planmode, scorpiox-printlogs, scorpiox-pwsh, scorpiox-renderimage, scorpiox-rewind, scorpiox-screenshot, scorpiox-sdk, scorpiox-search, scorpiox-server, scorpiox-server-email, scorpiox-server-fetchtoken, scorpiox-server-http2tcp, scorpiox-skills, scorpiox-systemprompt, scorpiox-tasks, scorpiox-tmux, scorpiox-transcript, scorpiox-usage, scorpiox-vault-git, scorpiox-vi, scorpiox-voice, scorpiox-websearch Shared Library: libsx.dll

Windows-Specific Findings

Platform Abstraction

Windows code is cleanly separated via #ifdef SX_WINDOWS / #ifdef _WIN32 guards. Key adaptations:

• Process execution: _spawnvp() / CreateProcess() — safe argv-based execution (no shell)
• Temp directories: %TEMP% / %TMP% / C:\Temp
• Terminal: Windows Console API (SetConsoleMode, ReadConsoleInputW)
• Networking: Winsock2 (WSAStartup, closesocket)

Assessment

No registry manipulation, no service installation, no elevation of privilege, no kernel driver interaction. The Windows surface is well-guarded with appropriate platform abstractions.

---

15. Telemetry and Tracking

Agent: telemetry-tracking | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 2 Low, 1 Info

Verdict: No Tracking by Default ✅

Startup Behavior

Zero network calls on startup. The first network call occurs only when the user initiates a conversation with an AI provider.

Data Collection (When Opt-In Enabled)

Usage tracking collects: session ID, provider, model, hostname, username, OS, architecture, token counts, rate limits. Does NOT collect: IP address, conversation content, file contents, machine fingerprints. Session telemetry collects: all of the above plus full conversation content (prompts, responses, tool calls). The code explicitly acknowledges this privacy impact.

Findings

Corporate Deployment Recommendation

No configuration changes needed for zero-tracking. The product ships with all tracking disabled. For additional hardening, remove scorpiox-usage and scorpiox-emit-session binaries entirely — the main binary will silently fail the exec call.

---

16. Install Script & Distribution Security

Agent: install-script | Risk: MEDIUM | Findings: 0 Critical, 3 High, 5 Medium, 4 Low, 5 Info

Distribution Architecture

• Linux/macOS: curl|bash from get.scorpiox.net
• Windows: iwr|iex PowerShell pattern
• Updates: User-initiated via scorpiox-update (no auto-update)
• Integrity: SHA256 checksums from dist.scorpiox.net

High-Severity Findings

Medium-Severity Findings

Low-Severity Findings

Positive Controls

• HTTPS-only downloads ✅
• SHA256 checksums present (when available) ✅
• No auto-update — user-initiated only ✅
• No cron/launchd/systemd services installed ✅
• Release builds tracked by commit hash ✅

---

17. Consolidated Risk Matrix

Critical Findings (0)

No critical findings identified.

High Findings (12)

Medium Findings (39)

Low Findings (45)

Key categories:

• Network endpoints (8): Hardcoded non-critical URLs, localhost bindings
• Command injection (10): Windows system() with validated inputs, Linux sx_system_safe() with controlled data
• File I/O (5): Default permissions, conversation file permissions, temp cleanup
• Memory (4): Diagnostic allocations, minor leak paths
• Buffer (2): Large stack buffers, tmux env injection
• TLS (2): mbedTLS no cert verify scope, opportunistic STARTTLS
• Build (3): Suppressed warnings, missing PIE, missing format-security
• Windows deployment (3): Unencrypted beam protocol, server binds 0.0.0.0, DNS binds 0.0.0.0
• Telemetry (2): Opt-in conversation/metadata transmission
• Install (4): Branch selection, chmod glob, RC file modification, no version pinning
• Privilege (2): KVM group requirement, cgroup write access

---

18. Conclusion & Recommendations

Overall Assessment

SCORPIOX CODE demonstrates a mature security posture for an AI-powered development tool written in pure C. The zero-dependency architecture, comprehensive compiler hardening, and systematic command injection mitigation are notable strengths. The codebase has undergone visible iterative security improvement — evidenced by the completed O_CLOEXEC hardening pass, the CJ-01 through CJ-13 injection fix series, and the 39% reduction in findings since the previous audit.

Priority Recommendations

Immediate (HIGH — before next release)

Harden SHA256 verification — change soft-fail to hard-fail in all install/update scripts

Fix snprintf return clamping in scorpiox-server.c lines 2107 and 2565 — trivial fix, pattern exists in same file

Add allocation size bounds in sx_http_relay.c — cap body_len and err_len to reasonable maximums

Remove hardcoded IP 20.53.240.54 from WASM embedded config — use hostname only

Short-Term (MEDIUM — within 30 days)

Implement code signing for distribution binaries (Authenticode for Windows, GPG for Linux)

Add scorpioxcode.exe SHA256 verification to Windows installer

Replace Windows system()/_popen() calls with CreateProcess() in OTP handler and sx_rmrf()

Add HSTS header to dist.scorpiox.net Caddy configuration

Create sx_fopen() wrapper that adds "e" mode flag for CLOEXEC on all platforms

Add integer overflow checks before allocation size calculations

Long-Term (LOW — within 90 days)

Implement reproducible builds with SLSA provenance attestation

Add atomic install/rollback to all platform installers

Consider MSI installer for Windows enterprise deployment (avoids -ExecutionPolicy Bypass)

Separate checksum hosting from binary hosting infrastructure

Evaluate -fPIE/-pie for dynamic build configurations

Risk Rating Summary

---

19. Appendix: Audit Methodology

Audit Agents

Scan Coverage

Severity Classification

Tools & Techniques

• Static analysis via pattern matching (grep, ripgrep) across all source files
• Manual code review of all flagged patterns with false-positive elimination
• Configuration analysis of build system (CMake), embedded configs, and install scripts
• Network endpoint enumeration via URL/IP/domain regex extraction
• Binary inventory via CMake target analysis
• Live server header inspection (HSTS, TLS version)
• Differential analysis against previous audit (output/2026-04-29_3ad7dfc)

---

This report was generated by the SCORPIOX CODE Security Audit Pipeline on 2026-04-29. Classification: CONFIDENTIAL — For Corporate Review Only.