v3 candidate

internal/secrets/secrets.go

@@ -28,6 +28,8 @@ const (
 	argonKeyLen  = 32
 
 	saltLen = 32
+
+	maxVaultFileBytes = 10 * 1024 * 1024
 )
 
 // SecretStore manages encrypted credential storage.
@@ -331,6 +333,16 @@ func (s *SecretStore) save() error {
 
 // load reads and unmarshals the vault from disc.
 func (s *SecretStore) load() (*secretVault, error) {
+	info, err := os.Stat(s.vaultPath())
+	if err != nil {
+		return nil, fmt.Errorf("failed to stat vault file: %w", err)
+	}
+	if info.IsDir() {
+		return nil, errors.New("vault path is a directory")
+	}
+	if info.Size() > maxVaultFileBytes {
+		return nil, fmt.Errorf("vault file is too large: %d bytes exceeds %d bytes", info.Size(), maxVaultFileBytes)
+	}
 	data, err := os.ReadFile(s.vaultPath())
 	if err != nil {
 		return nil, fmt.Errorf("failed to read vault file: %w", err)

internal/secrets/secrets_test.go

@@ -1,7 +1,9 @@
 package secrets
 
 import (
+	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -267,6 +269,30 @@ func TestVaultPath(t *testing.T) {
 	}
 }
 
+func TestSecretStoreLoadRejectsOversizedVault(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, vaultFileName)
+	file, err := os.Create(path)
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	if err := file.Truncate(maxVaultFileBytes + 1); err != nil {
+		t.Fatalf("Truncate() failed: %v", err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatalf("Close() failed: %v", err)
+	}
+
+	store := NewSecretStore(dir)
+	_, err = store.load()
+	if err == nil {
+		t.Fatal("expected oversized vault to be rejected")
+	}
+	if !strings.Contains(err.Error(), "vault file is too large") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
 // ---------------------------------------------------------------------------
 // Redaction helpers
 // ---------------------------------------------------------------------------