secret-strobe

Runtime memory sanitizer for API secrets. API keys, JWTs, and database strings often linger in Node.js process memory long after they are needed, leaving them exposed to heap dumps and memory-scraping attacks. secret-strobe wraps sensitive values in a zero-fill buffer and wipes them from the heap once used or after a configurable TTL.

Why

Strings in JavaScript are immutable. Once a secret exists as a plain string, there is no reliable way to scrub it. secret-strobe keeps the value inside a Buffer it controls, exposes it through a guarded read(), and zero-fills that buffer on demand so the bytes actually leave memory.

Features

• Zero-fills the underlying buffer on wipe(), after a TTL, or immediately after read().
• Out-of-band monitor that alerts when high-entropy values linger in the heap past maxAge.
• Optional live heap scanning for suspicious high-entropy strings.
• No runtime dependencies, zero-fill via crypto.randomBytes.

Install

npm install secret-strobe

Usage

Wrap a secret

var strobe = require('secret-strobe');

var apiKey = strobe('sk_live_AbCdEfGh', {
  ttl: 5000,          // auto-wipe after 5 seconds
  wipeOnRead: false
});

// ...use it
console.log(apiKey.redact());   // c***** 24 chars

var value = apiKey.read();      // real value
doWork(value);

apiKey.wipe();                  // zero-fill now, no need to wait

Auto-wipe after a request

var strobe = require('secret-strobe');

function handler(req, res) {
  var token = strobe(req.headers.authorization, { wipeOnRead: true });
  try {
    authenticate(token.read());
  } finally {
    token.wipe();
  }
}

Out-of-band heap monitoring

var strobe = require('secret-strobe');

strobe.monitor.on('warn', function (secret, info) {
  console.warn('High-entropy value found in memory:', info);
});

strobe.monitor.on('alert', function (secret, redacted) {
  console.warn('Secret exceeded maxAge:', redacted);
  secret.wipe();
});

strobe.start({ interval: 5000 });

Heap scanning

strobe.start({
  scanHeap: true,
  heapScanInterval: 30000,
  entropyThreshold: 4.5,
  minLength: 12
});

The heap scanner walks the V8 snapshot and reports strings whose Shannon entropy exceeds the threshold.

API

strobe(value, options?)

Returns a new Secret and registers it with the default monitor.

• value - string or Buffer
• options.encoding - encoding used when reading (utf8 default)
• options.ttl - auto-wipe after this many ms
• options.maxAge - alert threshold for the monitor (ms)
• options.wipeOnRead - wipe immediately after read()

Secret

• read() / toString() - return the value, throws if wiped or expired
• wipe() / destroy() - zero-fill the buffer
• expired() - has the value aged past its TTL/maxAge
• redact() - safe display string
• .length, .entropy, .wiped, .createdAt

strobe.monitor

Default Monitor instance.

• monitor.on(event, fn) - alert, warn, start, stop
• monitor.start(options?) - begin periodic checks
• monitor.stop() - stop checks
• monitor.observe(secret) / monitor.release(secret)

strobe.start(options?) / strobe.stop()

Convenience wrappers that configure and start/stop the default monitor.

License

MIT