worldcoin / worldcoin/walletkit
Use platform temporary directory for plaintext vault backup files
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 19
- Forks
- 7
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 35
Description
The plaintext vault backup (used for backup sync) is currently written to the worldid data directory alongside the encrypted vault. Since this file contains unencrypted sensitive data, there would be more defense in depth if it was written to the platform's temporary directory instead. If a client-side bug prevents the caller from deleting the file, the OS will eventually clean it up.
Platform behavior:
- iOS: NSTemporaryDirectory() — OS cleans up periodically and on reboot. Files get NSFileProtectionComplete by default (encrypted at rest when locked).
- Android: Context.getCacheDir() — OS can evict under disk pressure, but doesn't guarantee cleanup on reboot. Still better than the persistent data directory.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by locating where plaintext vault backup files are created and where the iOS and Android storage paths are selected; compare those entry points with NSTemporaryDirectory() and Context.getCacheDir(). Done means backup files use the platform temporary or cache directory on both platforms while backup sync continues to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, ios, rust
- Domain
- mobile, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100