onepub-dev / onepub-dev/reVault
review vault password env fallback
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 4
- Forks
- 0
- Avg merge
- 1h 55m
- Merged PRs (30d)
- 1
Description
Low/Medium: Vault password environment fallback is convenient but weak for high-security use. LOCKBOX_VAULT_PASSWORD is used both by normal CLI vault
access and backup unlock fallback. Even if SecretString::try_from_env() copies it into secure storage, the original process environment remains outside
the secure heap. See rust/lockbox_cli/src/commands/context.rs:90 and rust/lockbox_vault/src/lib.rs:234.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading rust/lockbox_cli/src/commands/context.rs:90 and rust/lockbox_vault/src/lib.rs:234, then trace how LOCKBOX_VAULT_PASSWORD reaches normal CLI access and backup unlock fallback. Review whether SecretString::try_from_env() leaves the original process environment exposed; done means the high-security handling decision is implemented consistently across both paths.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cli, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100