Password string kept in memory without zeroisation

[ybrs]

🛠️ Refactor suggestion

Password string kept in memory without zeroisation

WorkerMessage::Authentication stores the clear-text password in a String.
Because the password travels across threads and is never zeroised, it will linger in memory longer than necessary and can end up in logs/heap dumps.

Consider holding the password in a Vec<u8> and wiping it after use, or at minimum documenting that TLS is mandatory when the authentication hook is enabled.

🤖 Prompt for AI Agents

In src/lib.rs around lines 100 to 107, the Authentication struct stores the
password as a clear-text String, which remains in memory without zeroisation. To
fix this, change the password field type from String to Vec<u8> to hold the
password bytes, and implement logic to securely wipe (zeroise) the password data
from memory after use. Alternatively, if changing the type is not feasible, add
documentation clearly stating that TLS is mandatory when the authentication hook
is enabled to mitigate exposure risks.

Originally posted by @coderabbitai[bot] in #30 (comment)