MuseAlpha Production Audit — Complete Fix Set

Summary

Full security audit and stability fix for production release. Fixes 13 issues across 11 files — 5 critical security vulnerabilities, 4 stability bugs, and 4 quality/correctness issues.

🔴 CRITICAL Security Vulnerabilities Fixed

1. Insecure Password Generation (credentials.rs)

Before: Used timestamp_subsec_nanos() as seed — completely predictable. An attacker knowing the approximate time can reproduce any generated password.
After: Uses rand::rngs::OsRng (CSPRNG) with Fisher-Yates shuffle and guaranteed character class coverage.

2. Hardcoded KDF Salt (lib.rs)

Before: All installations shared the same static salt b\"muse-vault-kdf-salt-2026-v1-prod\". If one vault is compromised, rainbow tables work against ALL users.
After: Salt is derived per-machine using SHA-256(static_salt || hostname). Each installation has a unique salt.

3. Content Security Policy Disabled (tauri.conf.json)

Before: \"csp\": null — no CSP at all. XSS in any loaded page could execute arbitrary code with full Tauri IPC access.
After: Restrictive CSP allowing only necessary sources.

4. Arbitrary File Path Write (settings.rs)

Before: board_export_file accepted any filepath string with no validation — could write to /etc/passwd, C:\\Windows\\System32, etc.
After: Path traversal detection, system directory blocklist, parent existence check, and 100MB import size limit.

5. Wildcard CORS on Internal Protocol (lib.rs)

Before: Access-Control-Allow-Origin: * on muse-action:// handler responses. Combined with the remote.urls: [\"https://*\"] capability, any website could potentially probe internal state.
After: No CORS headers (internal protocol doesn't need them). Remote URL wildcard removed from capabilities.

🟡 Stability Bugs Fixed

6. Mutex Panics Crash the App (browser/commands.rs)

Before: Multiple .expect(\"tabs lock\") calls — if the mutex is ever poisoned (e.g., by a panic in another thread), the entire app crashes.
After: All mutex access uses .map_err() for graceful error propagation.

7. Unbounded Memory Growth (browser/commands.rs)

Before: SEEN_CAPTURE_IDS HashSet grew without limit. On a long session with hundreds of captures, this leaked memory indefinitely. The "cleanup" code removed a random element which doesn't bound growth.
After: Replaced with a bounded VecDeque<String> (FIFO, capped at 1024).

8. Duplicate Event Listener Race Condition (store.tsx + App.tsx)

Before: board://image_added was listened to in BOTH store.tsx AND App.tsx. This caused images to be inserted twice into the canvas array, with different IDs, creating ghost duplicates.
After: Single listener in store.tsx only. App.tsx comment documents the decision.

9. Undo History Memory Leak (store.tsx)

Before: History used JSON.stringify() comparison on every state change (expensive GC pressure on large boards) and the cap at 200 entries had a logic error that allowed unbounded growth.
After: Uses refs for O(1) access, proper bounded array with shift(), and a dirty flag instead of JSON comparison.

🟢 Quality & Correctness Fixes

10. Session Data Loss (sessions.rs)

Before: sessions_save called .retain(|s| !s.is_auto) which deleted ALL auto-saves whenever a manual save happened. Users lost their crash-recovery snapshots.
After: Separate limits for manual (50) and auto (5) sessions.

11. Vault Auto-Lock Missing (credentialsVault.ts)

Before: Once unlocked, the vault stayed open forever until the app was closed. If the user walks away, credentials are exposed.
After: 15-minute auto-lock timeout with user notification event.

12. Vault Detector Breaks Web Pages (vault_detector.js)

Before: Monkey-patched window.fetch and XMLHttpRequest.prototype.send globally. This broke pages that check function identity, interfered with service workers, and leaked credential-entry timing.
After: Removed fetch/XHR interception. Uses only form-submit and button-click detection.

13. Product Naming Inconsistency

Before: Mixed "Refstudio" and "MuseAlpha" throughout — confusing for users and breaks branding. Window title said "Refstudio", panic message said "Refstudio", etc.
After: Consistently "MuseAlpha" everywhere.

New Dependencies Added

• rand = \"0.8\" — cryptographic random number generation
• gethostname = \"0.5\" — per-machine salt derivation

Files Changed (11)

• src-tauri/Cargo.toml
• src-tauri/tauri.conf.json
• src-tauri/capabilities/default.json
• src-tauri/src/lib.rs
• src-tauri/src/credentials.rs
• src-tauri/src/settings.rs
• src-tauri/src/library.rs
• src-tauri/src/sessions.rs
• src-tauri/src/browser/commands.rs
• src-tauri/resources/scripts/vault_detector.js
• src/store.tsx
• src/App.tsx
• src/credentialsVault.ts