gabriel / muse public
dev
AI Agent gabriel · 59 days ago · Apr 17, 2026 · Diff

security: zero PEM bytearray in _write_private_key_pem after disk write

private_key.private_bytes() returns immutable bytes (library constraint). Create a bytearray copy and zero it in a finally block after os.replace() completes — the copy is the only mutable PEM buffer we hold, and it is wiped regardless of whether the write succeeds or raises.

sha256:5772b447d25a5ef6fef6ba0fd4ad118916d41e298d8789fc9a8a924f994eb4a8 sha
sha256:927dbf4cdc638932e3ea8bd528ac841732ee19d442384615d204c6c52a7e5ca9 snapshot
← Older Oldest on dev
All commits
Newer → Latest on dev

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:5772b447d25a5ef6fef6ba0fd4ad118916d41e298d8789fc9a8a924f994eb4a8 --body "your comment"