🟠 [HIGH] CB-006: Nostr Private Key Exposure Risk #15

New issue

Open

opened 2026-02-20 08:50:03 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:03 +00:00

Security Finding from Audit

Parent issue: #1

Severity

HIGH 🟠

CVSS Score

N/A

CWE

CWE-312 (Cleartext Storage of Sensitive Information)

Location

nostr/plugin.py, configure() / start()

Description

The Nostr nsec (private key) is loaded from multiple sources (env var, config file, identity file) and stored as a Python object in memory. The private key hex is passed to multiple pynostr functions.

Combined with CB-002 (file read), the identity file or config file containing the nsec can be exfiltrated. Combined with CB-001 (exec), /proc/self/environ exposes NOSTR_NSEC if set as environment variable.

Recommendation

Use a hardware security module or OS keyring for key storage
Never log the private key; implement constant-time comparison
Restrict file permissions on identity files to 0600

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-006

## Security Finding from Audit > Parent issue: #1 ### Severity **HIGH** 🟠 ### CVSS Score N/A ### CWE CWE-312 (Cleartext Storage of Sensitive Information) ### Location `nostr/plugin.py, configure() / start()` --- ### Description The Nostr `nsec` (private key) is loaded from multiple sources (env var, config file, identity file) and stored as a Python object in memory. The private key hex is passed to multiple pynostr functions. Combined with CB-002 (file read), the identity file or config file containing the nsec can be exfiltrated. Combined with CB-001 (exec), `/proc/self/environ` exposes `NOSTR_NSEC` if set as environment variable. --- ### Recommendation - Use a hardware security module or OS keyring for key storage - Never log the private key; implement constant-time comparison - Restrict file permissions on identity files to `0600` --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-006*