zeroize-audit

Compare LLVM IR emitted at -O0 versus -O1 and -O2 for the translation unit. If the wipe stores or llvm.memset call present at O0 disappear at higher optimization levels, dead-store elimination removed the wipe; replace it with explicit_bzero, memset_s, or a volatile wipe loop.

Provide the path to Cargo.toml and ensure cargo check passes with a nightly toolchain available. The audit analyzes MIR, LLVM IR, and assembly to verify zeroize::Zeroize, Zeroizing<T>, or ZeroizeOnDrop usage and detects copies of secrets lacking tracked wipes.

You need a compile_commands.json generated from a clean build (via CMake with CMAKE_EXPORT_COMPILE_COMMANDS=ON or Bear), clang on PATH for IR and assembly emission, and uvx if Serena MCP semantic analysis is desired. Missing prerequisites cause defined fail-fast or downgrade behavior.

Yes, when mcp_mode is set to prefer, the audit continues without MCP but downgrades SECRET_COPY, MISSING_ON_ERROR_PATH, and NOT_DOMINATING_EXITS findings to needs_review confidence. With mcp_mode=require, the run stops if MCP is unreachable.

Findings like OPTIMIZED_AWAY_ZEROIZE, STACK_RETENTION, and REGISTER_SPILL describe compiler and machine-level behavior that cannot be proven from source alone. The audit enforces non-negotiable evidence requirements, such as an IR diff showing the wipe present at O0 but absent at O2.

Proof-of-concept generation for Rust supports only MISSING_SOURCE_ZEROIZE, SECRET_COPY, and PARTIAL_WIPE via cargo test; other Rust categories are marked poc_supported=false. AArch64 assembly analysis is experimental and its findings require manual verification.