zeroize-audit - Audit sensitive-data zeroization in C, C++, and Rust
Audits sensitive-data handling for missing or optimized-away zeroization using source, data-flow, IR, assembly, and control-flow evidence.
Tags
Updated: 2026-10-08Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Detect missing zeroization
- Identify optimized-away wipes
- Track secret data copies
- Analyze assembly and LLVM IR
- Verify control-flow cleanup
- Check insecure heap allocation
- Generate validation tests
- Generate proof-of-concept files
Inputs
- Repository root
- Compilation database
- Rust Cargo manifest
- Zeroization configuration
- Optimization levels
- Target languages
- Translation-unit limit
- MCP usage mode
- PoC categories
- PoC output directory
- Analysis feature flags
Outputs
- Structured JSON audit report
- Persistent finding files
- Analysis artifacts
- Generated proof-of-concept files
- Tool warnings and status
Requirements
- C/C++ compile_commands.json or Rust Cargo.toml
- Compilable C/C++ translation units or passing cargo check
- clang for C/C++ analysis
- cargo +nightly for Rust analysis
- uv for Rust analysis scripts
- Required analysis tools and scripts
- generate_poc.py
- LLVM IR emission support
- Assembly emission support when enabled
- Serena MCP when required