# Security audit: `kushBitxHQ/kushbitx-sdk`

Audit target: `https://github.com/kushBitxHQ/kushbitx-sdk`

Audited commit: `00aa7d18cd4230aa776477fef5c10a97bb942843`

Audit window (UTC): 2026-10-03 00:15:00Z–00:16:00Z

## Finding KX-01 — report files can retain permissive permissions

Severity: Low (local confidentiality / defense in depth)

Affected code: `agent.mjs`, `consume()`:

```js
await writeFile(reportFile, JSON.stringify(data, null, 2), { mode: 0o600 });
```

Node applies the `mode` option when creating a file. When the path already
exists, `writeFile()` truncates and rewrites it but does not change its existing
permission bits. Therefore a report file created or pre-created as `0644`,
`0660`, or otherwise shared remains shared even though this call requests
`0600`. Reports can contain service responses and the recovery/report workflow
should not assume that the path is private.

### Reproduction

1. Create an existing report path with mode `0644`.
2. Run the documented free preview with `REPORT_FILE` pointing to that path.
3. Inspect the file mode.

Observed run against the audited checkout:

```text
REPORT_FILE=/tmp/kushbitx-report-35R3hp node agent.mjs
exit status: 0
resulting mode: 644
```

The same behavior is reproduced by the application path with a pre-existing
`0644` report file; the report contents were not included here.

### Impact

On a multi-user workstation, a local user or process able to read the report
path can access data that the SDK caller expected to be protected by the
`0600` option. This is primarily relevant when `REPORT_FILE` points at a
persistent or shared path. It does not expose a private key by itself.

### Fix recommendation

After writing, explicitly enforce the mode, or create the file exclusively and
fail closed if it already exists:

```js
import { chmod } from 'node:fs/promises';

await writeFile(reportFile, JSON.stringify(data, null, 2), { mode: 0o600 });
await chmod(reportFile, 0o600);
```

Prefer a private temporary path followed by an atomic rename when reports may
be written in a directory controlled by another process. Add a regression test
that starts with a pre-existing `0644` report path and asserts `0600` after a
successful run.

## Scope and limitations

This review covered the checked-in JavaScript client and example runner at the
pinned commit. It did not test the remote KushBitx service, paid endpoints,
wallet signing, or any deployment filesystem. No destructive or paid request
was made. I found one reproducible local file-permission issue and did not
claim unverified server-side vulnerabilities.