Third-Party Software Security Review — SCORPIOX CODE

---

1. Executive Summary

This report consolidates findings from 14 specialized security audit agents examining the SCORPIOX CODE codebase at commit fe4a27d. The audit covers supply chain integrity, build provenance, network security, TLS configuration, credential handling, file I/O safety, buffer safety, memory safety, command injection, privilege management, Windows deployment scope, telemetry practices, install script security, and the WPF launcher application.

Key Metrics

Assessment Summary

SCORPIOX CODE demonstrates strong security engineering discipline across a 148K-line pure-C codebase. The project achieves a safe-to-unsafe string function ratio of 3,464:1, enforces centralized TLS verification by default, uses fork()+execvp() over system() for process spawning, vendors only two well-maintained C libraries (mbedTLS 3.6.6, yyjson 0.12.0), and ships zero third-party runtime dependencies in its Windows distribution. Both telemetry systems are disabled by default with no mandatory data collection.

No critical or high-severity findings were identified. The 14 medium-severity findings are concentrated in three areas: (1) file I/O edge cases on multi-user Linux systems, (2) command injection in the Linux-only container init process (requires filesystem control), and (3) install script integrity gaps (same-origin checksums without independent code signing). Most medium findings do not apply to the primary Windows workstation deployment.

---

2. Deployment Scope — Windows Workstation vs Server-Side

2.1 Primary Deployment: Windows Workstation

The following binaries are compiled for and deployed on Windows:

Total: 55 Windows binaries (53 executables + 1 DLL + 1 symlink)

2.2 Linux/Unix-Only Binaries (NOT deployed on Windows)

2.3 Windows-Filtered Findings Summary

Of the 155 total findings, 17 are Linux/Unix-only and do not apply to Windows workstation deployments:

Windows deployment finding count: 138 (0 Critical, 0 High, 10 Medium, 38 Low, 90 Info)

---

3. Changes Since Last Audit

Previous Audit: output/2026-04-30_6851bc0 (commit 6851bc0, 2026-04-30) \Note: The Windows finding count increase reflects improved granularity in the Windows deployment analysis (14 agents vs 13 previously, with the addition of the WPF launcher audit contributing 22 findings). The actual security posture improved — all Critical and High findings were remediated.*

Key Improvements Since Last Audit

All 2 Critical findings eliminated — zero critical findings remain

All 6 High-severity findings eliminated — zero high findings remain

Medium findings reduced by 63% (38 → 14)

Commit fe4a27d specifically addresses Windows command injection findings CJ-16, CJ-17, CJ-18 (per commit message: "security: fix 3 Windows command injection findings")

Overall risk rating improved from LOW-MEDIUM to LOW

---

4. Supply Chain & Dependencies

Agent: supply-chain | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 1 Low, 5 Info

Key Findings

The project has an exceptionally minimal supply chain for a software platform of this scale:

• Vendored libraries: Only 2 — mbedTLS 3.6.6 (LTS, Apache-2.0/GPL-2.0+) and yyjson 0.12.0 (MIT)
• No package manager dependencies in the core C build (no npm, pip, cargo, go modules)
• No pre-built binaries in the source repository
• No FetchContent, ExternalProject, or git submodules
• Windows release: Exclusively native binaries (.exe, .dll) — no interpreted runtimes

An optional WhatsApp bridge component (bridge/) uses Bun/TypeScript with 2 npm dependencies, but this is not part of the core build system or Windows distribution.

---

5. Build System & Code Provenance

Agent: build-provenance | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 2 Low, 5 Info

Build Security Highlights

• Compiler hardening: -Wall -Wextra -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fcf-protection (GCC)
• Linker hardening: Full RELRO (-Wl,-z,relro,-z,now), non-executable stack (-Wl,-z,noexecstack)
• Static linking by default (SX_STATIC_LINK=ON)
• 1,225 commits with traceable history
• Model header generation frozen — Python code generator not run in CI, header checked into source

---

6. Network Endpoints

Agent: network-endpoints | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 3 Low, 7 Info

Network Architecture

78 unique hardcoded endpoints across 43 source files. All external connections use HTTPS. Endpoints fall into three categories:

First-party infrastructure (*.scorpiox.net) — distribution, token services, API proxying

Third-party LLM APIs — Anthropic, OpenAI, Google AI, Z.AI (all HTTPS)

Localhost services — HTTP for local IPC only

---

7. TLS/SSL Security

Agent: tls-security | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 3 Low, 9 Info

TLS Architecture

All libcurl HTTPS connections route through a centralized sx_curl_set_tls() helper enforcing certificate verification by default. All mbedTLS contexts enforce TLS 1.2 minimum. The SMTP server correctly requires STARTTLS before AUTH on submission port 587.

---

8. Hardcoded Credentials

Agent: credential-hardcode | Risk: LOW | Findings: 0 Critical, 0 High, 2 Medium, 3 Low, 3 Info

Assessment

No actual secret values (API keys, passwords, tokens) were found hardcoded in the source code. All sensitive configuration fields use empty-string defaults and are populated at runtime via environment variables or configuration file.

---

9. File I/O & Data Handling

Agent: file-io | Risk: MEDIUM | Findings: 0 Critical, 0 High, 3 Medium, 5 Low, 5 Info

File I/O Security Controls

• Centralized sx_fopen() sets FD_CLOEXEC on all file descriptors
• Consistent mkstemp()/mkdtemp() usage (31 call sites)
• sx_config_is_sensitive() redacts API keys/tokens in logs
• Config files written with chmod(0600), directories with mkdir(0700)
• Traffic log headers redacted (x-api-key, Authorization)

---

10. Buffer Safety

Agent: buffer-safety | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 3 Low, 6 Info

Buffer Safety Metrics

Safe:Unsafe ratio = 3,464:1

---

11. Memory Safety

Agent: memory-safety | Risk: LOW | Findings: 0 Critical, 0 High, 2 Medium, 2 Low, 4 Info

Memory Management Practices

The vast majority of malloc/calloc/realloc calls have proper NULL checks. realloc calls use a temporary variable pattern to avoid pointer loss.

---

12. Command Injection

Agent: command-injection | Risk: LOW | Findings: 0 Critical, 0 High, 2 Medium, 3 Low, 5 Info

Remediation Progress

The commit under review (fe4a27d) specifically fixes 3 Windows command injection findings (CJ-16, CJ-17, CJ-18). Most system() calls have been replaced with fork()+execvp() or CreateProcess on Windows.

---

13. Privilege & Access Control

Agent: privilege-access | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 3 Low, 12 Info

Security Architecture

The container runtime (scorpiox-unshare) uses Linux user namespaces, pivot_root, overlayfs, and seccomp BPF. The runtime avoids setuid, uses PR_SET_NO_NEW_PRIVS, drops capabilities, clears environment before exec, and uses fork+execvp instead of system().

Important context: The container runtime runs trusted first-party agents on a private network — not untrusted workloads. Findings are rated against this threat model, not against generic container security checklists.

---

14. Windows Deployment Analysis

Agent: windows-deployment | Risk: LOW | Findings: 0 Critical, 0 High, 1 Medium, 3 Low, 9 Info

Windows Security Highlights

• CreateProcess-based execution (no cmd.exe /c with user input)
• Metacharacter validation on shell arguments
• SHA256-verified self-updates
• User-scoped installation (no admin/UAC required)
• Proper argument quoting in Windows command construction

---

15. Telemetry and Tracking

Agent: telemetry-tracking | Risk: LOW | Findings: 0 Critical, 0 High, 0 Medium, 1 Low, 4 Info

Verdict: No Tracking by Default

Both telemetry systems (USAGE_TRACKING and EMIT_SESSION_TRACKING) are disabled (0) in all configuration tiers: compiled defaults, embedded config, and shipped config file. No network telemetry occurs out of the box.

Mandatory Data Collection: NONE — All telemetry is fully opt-in.

---

16. Install Script & Distribution Security

Agent: install-script | Risk: MEDIUM | Findings: 0 Critical, 0 High, 3 Medium, 7 Low, 7 Info

Distribution Security Architecture

• All downloads use HTTPS with HSTS on dist.scorpiox.net
• SHA256 checksum verification enforced by default on all platforms
• Per-commit build provenance via build-info.json
• Windows installer uses user-scoped PATH (no admin required)

---

17. WPF Launcher (scorpioxcode.exe)

Agent: wpf-launcher | Risk: LOW | Findings: 0 Critical, 0 High, 1 Medium, 5 Low, 16 Info

WPF Security Highlights

• Zero NuGet package dependencies (all .NET Framework BCL)
• P/Invoke bindings with proper free-after-copy pattern
• SHA256-verified dependency downloads
• Static callback delegate pinning (prevents GC collection)
• No embedded browser (eliminates XSS-class risks)
• Deterministic build enabled

---

18. Consolidated Risk Matrix

Medium-Severity Findings

Low-Severity Findings (Summary by Area)

---

19. Conclusion & Recommendations

Overall Assessment

SCORPIOX CODE achieves a LOW overall risk rating with zero Critical and zero High findings across 155 total observations from 14 audit agents. This represents a significant improvement from the previous audit (225 findings including 2 Critical and 6 High). The commit under review specifically addresses Windows command injection vulnerabilities, demonstrating active security remediation.

Top Recommendations (Priority Order)

Implement independent code signing (GPG or Sigstore) for release artifacts to establish a trust anchor independent of the distribution server (IS-01)

Fix CharSet.Ansi marshalling in the WPF launcher to prevent non-ASCII input corruption (WPF-02)

Add log rotation and configurable body logging to prevent indefinite sensitive conversation persistence (FIO-01)

Use realpath() validation consistently for all path traversal checks (FIO-02)

Remove dead code in scorpiox-wsl.c check_for_update() or fix the SHA256 parse-error handling (IS-03)

Add input validation for scorpiox-init descriptor fields and INIT_TOOLS environment variable (CJ-01, CJ-02, Linux-only)

Fix the sx_api_init() memory leak by removing the redundant early return at line 108 (MEM-01)

Expand seccomp blocklist with additional commonly-blocked syscalls for defense-in-depth (PA-02, Linux-only)

Strengths

• Exceptional buffer safety discipline (3,464:1 safe-to-unsafe ratio)
• Centralized TLS configuration with fail-closed defaults
• Zero third-party runtime dependencies in Windows distribution
• Both telemetry systems disabled by default with no mandatory collection
• Active security remediation visible in commit history
• Clean supply chain — only 2 vendored libraries, both current LTS/stable releases
• Comprehensive security hardening flags in build system

---

Appendix: Audit Methodology

Agents Deployed

Analysis Approach

• Static analysis of 224 non-vendor C/H source files (148,135 lines)
• Configuration review of embedded defaults, shipped config files, and build system
• Threat model-aware rating: Findings rated against the actual deployment context (trusted first-party agents on private network), not against generic container/server security checklists
• Platform-scoped findings: Each finding tagged with platform applicability (Windows/Linux/macOS/All)
• Delta analysis: Comparison with previous audit at commit 6851bc0 to track remediation progress

Severity Definitions