Cryptography & Security Model

Zero-knowledge cloud password protection

When a user applies a password to a Cloud Share snippet, the plaintext password is never transmitted to Firebase. Veyrix uses the native Web Crypto API to generate a SHA-256 hash locally instead:

// Internal Utility Method
async function hashPassword(password) {
    const msgBuffer = new TextEncoder().encode(password);
    const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
    const hashArray = Array.from(new Uint8Array(hashBuffer));
    return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

Threat model assumptions

1. Physical security

Veyrix relies completely on the local OS and browser profile. If an attacker gains physical, unlocked access to the device, or compromises the browser profile (e.g. via a malicious extension), the IndexedDB store is considered compromised.

2. Cross-Site Scripting (XSS)

Veyrix is an editor, not an evaluator. The Ace Editor parses content into Abstract Syntax Trees (ASTs) for highlighting — it does not execute code within the DOM. DOM string interpolations are secured via native textContent mappings.

3. Cloud anonymity

Firebase interactions use signInAnonymously(). Data is tied to a temporary, anonymous session UID. Firebase Security Rules are assumed to enforce read/write access correctly based on the snippet UID, but shared URLs are considered semi-public unless protected with the SHA-256 password hash described above.