Skip to content

sec(storage): implement in-memory secret scrubbing for database passwords and credentials #607

Description

@ZhuchkaTriplesix

Motivation & Goal

Enhance zero-trust memory security by clearing/scrubbing in-memory password representations and plaintext credential buffers immediately after establishing database connections.

Proposed Scope

  • Zero-out or discard sensitive password buffers in ConnectionRow, ConnectionSecretsStore, and driver connection factories once authentication handshake succeeds.
  • Avoid retaining plaintext database passwords in long-lived client state models when only connection handles/leases are needed.
  • Add unit tests validating that sensitive in-memory credentials are not retained across active connection lifecycles.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requeststorageTheme parser epic label: storage

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions