Summary
Encrypted package creation stages the source tree and inner ZIP in plaintext temporary storage. Unlocking an encrypted package also materializes a plaintext inner ZIP. Normal error and shutdown paths attempt cleanup, but SIGKILL, Task Manager termination, crashes, power loss, and failed best-effort deletion bypass those paths.
There is no startup scavenger for owned BundlePack temporary artifacts.
Impact
Plaintext source data from a package that the user intended to store encrypted can remain on disk and become accessible to the same account, administrators, backups, or forensic recovery.
Evidence
Windows/BundlePack.Core/BundlePackService.cs:45-49,144-147,173-205Windows/BundlePack.Core/Models.cs:111-127Windows/BundlePack.Core/FileHelpers.cs:87-115macOS/BundlePack/App/PackageBuilder.swift:73-81macOS/BundlePack/App/AppModel.swift:194-239,286-292macOS/BundlePack/Shared/EncryptedContainer.swift:188-208
Reproduction outline
- Start encrypted creation and terminate the process while staging or compressing.
- Unlock an encrypted package and terminate the process before the opened package is disposed.
- Inspect the platform temporary directory for
BundlePack-*, archive.zip, BundlePack-Decrypted-*, or BundlePack-Opened-* artifacts.
The audit confirmed the lifetime gap statically; destructive abnormal-termination tests were not run.
Proposed change
- Introduce an owner-only BundlePack temporary-directory manager.
- Apply restrictive permissions or ACLs before plaintext is written.
- Record enough ownership metadata to distinguish BundlePack artifacts from unrelated files.
- On startup, remove only stale entries after validating owner, prefix, non-symlink status, type, and age.
- Prefer lifetime-bound handles such as
DeleteOnClose on Windows or open-then-unlink patterns on macOS where compatible.
- Surface cleanup failures in diagnostics without exposing package metadata or passwords.
Acceptance criteria
- Normal completion, cancellation, and handled failures leave no plaintext artifacts.
- A simulated prior-session stale directory is safely removed on startup.
- Symlink, wrong-owner, unexpected-type, and fresh-session entries are never followed or deleted.
- Temporary files are owner-only before their first plaintext write.
- Tests cover deletion failure and application restart.
Compatibility constraints
Keep the encrypted inner ZIP design, streaming behavior, password non-persistence, and the rule that the entire expanded payload must not be loaded into memory. Document that cleanup cannot guarantee secure erasure on SSDs.
Summary
Encrypted package creation stages the source tree and inner ZIP in plaintext temporary storage. Unlocking an encrypted package also materializes a plaintext inner ZIP. Normal error and shutdown paths attempt cleanup, but
SIGKILL, Task Manager termination, crashes, power loss, and failed best-effort deletion bypass those paths.There is no startup scavenger for owned BundlePack temporary artifacts.
Impact
Plaintext source data from a package that the user intended to store encrypted can remain on disk and become accessible to the same account, administrators, backups, or forensic recovery.
Evidence
Windows/BundlePack.Core/BundlePackService.cs:45-49,144-147,173-205Windows/BundlePack.Core/Models.cs:111-127Windows/BundlePack.Core/FileHelpers.cs:87-115macOS/BundlePack/App/PackageBuilder.swift:73-81macOS/BundlePack/App/AppModel.swift:194-239,286-292macOS/BundlePack/Shared/EncryptedContainer.swift:188-208Reproduction outline
BundlePack-*,archive.zip,BundlePack-Decrypted-*, orBundlePack-Opened-*artifacts.The audit confirmed the lifetime gap statically; destructive abnormal-termination tests were not run.
Proposed change
DeleteOnCloseon Windows or open-then-unlink patterns on macOS where compatible.Acceptance criteria
Compatibility constraints
Keep the encrypted inner ZIP design, streaming behavior, password non-persistence, and the rule that the entire expanded payload must not be loaded into memory. Document that cleanup cannot guarantee secure erasure on SSDs.