chanora/docs/security/secure-storage-audit-report.md

Chanora Secure Storage Audit Report

Document status: DV meeting baseline candidate
Date: 2026-05-29

1. Scope

This report defines the secure-storage audit expected before public/store release.

2. Audit Matrix

Platform	Expected backend	Current evidence state
Android	Android secure storage / Keystore-backed protection where implemented	Android Keystore-backed DEK deferred to v1.1
iOS	Keychain	Device audit required
macOS	Keychain	Device audit required
Windows	Credential Manager	Device audit required
Linux	Secret Service with documented fallback behavior	Device audit required

3. Required Checks

Check	Required result
Secret persistence	Server passwords and identity secrets are not stored as unprotected plaintext
Fallback disclosure	Any file fallback is disclosed in release/security records
Diagnostic interaction	Stored secrets are registered for redaction where they can enter logs/export
CI behavior	CI keyring disabling is limited to headless test environments

4. DV Conclusion

Secure-storage audit requirements are defined, but per-platform audit evidence is not complete. Public/store release remains blocked for strong secure-storage claims.