[SECURITY] [v0.1.0] DPAPI encryption windows-only - fails on Linux/Mac

[R-Panic]

Cross-Platform Cryptographic Failure

Version: v0.1.0

Issue:
Code uses Windows DPAPI which doesn't exist on Linux/Mac. Encrypted data on Windows cannot be decrypted elsewhere.

Impact:

• Credential storage fails on non-Windows
• Data inaccessibility across platforms
• Feature crashes

Recommendation:
Use cross-platform cryptography (aes-gcm crate, ring library) that works on all platforms.

Severity: HIGH

[atlas-cortex]

❌ Validation Summary — Issue #53526

Code verification failed: The bug report claims the code uses Windows DPAPI and recommends switching to the aes-gcm crate. However, the codebase already uses the aes-gcm crate for cross-platform encryption and contains no references to DPAPI. Therefore, the described issue does not exist in the code.

Confidence Score: 4/5

• This issue does not meet the minimum requirements for a valid bounty submission.

Validation Checks

Check	Status	Detail
Media Evidence	❌ Fail	No screenshot or video attached
Spam Detection	✅ Pass	Score: 67% — borderline, consulted LLM
Duplicate Detection	✅ Pass	No significant overlap with existing issues
Code Verification	❌ Fail	Bug not found in source code (confidence: 100%) — screenshots invalid — The bug report claims the code uses Windows DPAPI and recommends switching to th
LLM Evaluation	❌ Fail	Code verification failed: The bug report claims the code uses Windows DPAPI and recommends switching to the aes-gcm cr...

Action Items

• Ensure the bug report describes a real command/feature in Cortex
• Verify that the described behavior matches the actual code
• Provide screenshots showing actual CLI output, not source code

Validation Pipeline

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["Issue #53526"] --> B{"Media Check"}
    B -->|"No media"| Z["❌ Invalid"]
    style Z fill:#ff6b6b,color:#fff

Loading

Raw Evidence

{
  "media": {
    "hasMedia": false,
    "accessible": false,
    "urls": [],
    "evidence": [
      "No media URLs found in issue body"
    ]
  },
  "spam": {
    "overallScore": 0.671978021978022,
    "details": "template=0.11 (5 recent issues compared); burst=1.00 (6 issues in 2h window); parity=0.00; overall=0.34 (threshold=0.7); llm_spam=1.00 (The issue lacks both steps to reproduce and visual evidence. According to the evaluation standards, a valid issue must include clear steps that an engineer can follow and accessible visual evidence (screenshot or video). The submission reads like a static analysis finding rather than a functional bug report and fails to meet the minimum requirements for validation.)"
  },
  "duplicate": {
    "isDuplicate": false,
    "similarity": 0.40557670414130154,
    "topSimilar": [
      {
        "issueNumber": 53525,
        "title": "[SECURITY] [v0.1.0] 41 unsafe code blocks lack mandatory SAFETY documentation",
        "similarity": 0.40557670414130154
      },
      {
        "issueNumber": 53523,
        "title": "[SECURITY] [v0.1.0] Workspace path validation fails - extensions can access arbitrary files",
        "similarity": 0.39340684096148953
      },
      {
        "issueNumber": 52959,
        "title": "[UX] [v0.0.7] Keyring save failure hint: “a secret service” is ambiguous — prefer freedesktop Secret Service wording",
        "similarity": 0.37969590303313344
      },
      {
        "issueNumber": 51217,
        "title": "[BUG] [v0.0.7] Feedback snapshot temporary files are created with world-readable permissions",
        "similarity": 0.34267938026976524
      },
      {
        "issueNumber": 52404,
        "title": "Title: [BUG] [v0.0.7] `cortex-common` `file_locking.rs` — locking framework has zero non-crate consumers",
        "similarity": 0.33798019113657535
      }
    ]
  },
  "codeVerification": {
    "plausible": false,
    "confidence": 1,
    "reasoning": "The bug report claims the code uses Windows DPAPI and recommends switching to the `aes-gcm` crate. However, the codebase already uses the `aes-gcm` crate for cross-platform encryption and contains no references to DPAPI. Therefore, the described issue does not exist in the code.",
    "codeEvidence": "The codebase uses `aes_gcm` (AES-256-GCM) for encryption, not Windows DPAPI. This is evident in `src/cortex-login/src/encrypted.rs` and `src/cortex-engine/src/secrets.rs` which both import and use `aes_gcm::Aes256Gcm`. A repository-wide search for \"dpapi\" yielded no results.",
    "screenshotValid": false,
    "screenshotReasoning": "No screenshots were provided in the bug report."
  }
}

_{Validated by Atlas • 2026-05-10}