zeroize-audit

Compile the translation unit to LLVM IR at O0, O1, and O2 and diff the outputs. If the wipe store or memset call is present at O0 but absent at O1 or O2, dead-store elimination removed it. Replace plain memset with explicit_bzero, memset_s, or a volatile wipe loop.

Scan for variables matching sensitive name patterns like key, secret, or token, then verify an approved wipe API such as explicit_bzero or OPENSSL_cleanse runs on every exit path with the correct size. The audit also checks heap allocations and secret copies.

Yes, it analyzes Rust crates via Cargo.toml using nightly toolchain MIR, LLVM IR, and assembly emission. It recognizes the zeroize crate's Zeroize trait, Zeroizing wrapper, and ZeroizeOnDrop derive as approved wipe patterns.

C/C++ projects need a compile_commands.json (generated via CMake or Bear) and clang on PATH. Rust projects need a buildable Cargo.toml, cargo nightly, and uv. Missing prerequisites cause a fail-fast stop rather than partial analysis.

Findings like OPTIMIZED_AWAY_ZEROIZE, STACK_RETENTION, and REGISTER_SPILL describe compiler behavior that cannot be proven from source alone. An IR diff or assembly excerpt is mandatory evidence, preventing false positives based on assumptions about compiler behavior.

Skip it for general code review without a security focus, performance optimization unrelated to secure wiping, or codebases with no identifiable secrets or sensitive values. It also requires a compilable codebase, so it cannot run on code that does not build.