{"action":"created","issue":{"url":"https://api.github.com/repos/defuse/php-encryption/issues/126","labels_url":"https://api.github.com/repos/defuse/php-encryption/issues/126/labels{/name}","comments_url":"https://api.github.com/repos/defuse/php-encryption/issues/126/comments","events_url":"https://api.github.com/repos/defuse/php-encryption/issues/126/events","html_url":"https://github.com/defuse/php-encryption/issues/126","id":112080761,"number":126,"title":"Decide whether or not to make a StackTraceProtector object for keys.","user":{"login":"defuse","id":4211072,"avatar_url":"https://avatars.githubusercontent.com/u/4211072?v=3","gravatar_id":"","url":"https://api.github.com/users/defuse","html_url":"https://github.com/defuse","followers_url":"https://api.github.com/users/defuse/followers","following_url":"https://api.github.com/users/defuse/following{/other_user}","gists_url":"https://api.github.com/users/defuse/gists{/gist_id}","starred_url":"https://api.github.com/users/defuse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/defuse/subscriptions","organizations_url":"https://api.github.com/users/defuse/orgs","repos_url":"https://api.github.com/users/defuse/repos","events_url":"https://api.github.com/users/defuse/events{/privacy}","received_events_url":"https://api.github.com/users/defuse/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/defuse/php-encryption/labels/v2.0","name":"v2.0","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/defuse/php-encryption/milestones/2","html_url":"https://github.com/defuse/php-encryption/milestones/v2.0%20release","labels_url":"https://api.github.com/repos/defuse/php-encryption/milestones/2/labels","id":1360010,"number":2,"title":"v2.0 release","description":"","creator":{"login":"defuse","id":4211072,"avatar_url":"https://avatars.githubusercontent.com/u/4211072?v=3","gravatar_id":"","url":"https://api.github.com/users/defuse","html_url":"https://github.com/defuse","followers_url":"https://api.github.com/users/defuse/followers","following_url":"https://api.github.com/users/defuse/following{/other_user}","gists_url":"https://api.github.com/users/defuse/gists{/gist_id}","starred_url":"https://api.github.com/users/defuse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/defuse/subscriptions","organizations_url":"https://api.github.com/users/defuse/orgs","repos_url":"https://api.github.com/users/defuse/repos","events_url":"https://api.github.com/users/defuse/events{/privacy}","received_events_url":"https://api.github.com/users/defuse/received_events","type":"User","site_admin":false},"open_issues":16,"closed_issues":21,"state":"open","created_at":"2015-10-16T18:26:44Z","updated_at":"2015-10-19T06:38:50Z","due_on":"2015-10-31T06:00:00Z","closed_at":null},"comments":6,"created_at":"2015-10-19T06:26:47Z","updated_at":"2015-10-19T16:35:58Z","closed_at":null,"body":"@paragonie-scott commented: https://github.com/defuse/php-encryption/issues/97#issuecomment-148881544\r\n\r\nThat's a good point. We should see if it's correct, and if not see if there's any way to structure the key object that would make it correct."},"comment":{"url":"https://api.github.com/repos/defuse/php-encryption/issues/comments/149274123","html_url":"https://github.com/defuse/php-encryption/issues/126#issuecomment-149274123","issue_url":"https://api.github.com/repos/defuse/php-encryption/issues/126","id":149274123,"user":{"login":"paragonie-scott","id":11591518,"avatar_url":"https://avatars.githubusercontent.com/u/11591518?v=3","gravatar_id":"","url":"https://api.github.com/users/paragonie-scott","html_url":"https://github.com/paragonie-scott","followers_url":"https://api.github.com/users/paragonie-scott/followers","following_url":"https://api.github.com/users/paragonie-scott/following{/other_user}","gists_url":"https://api.github.com/users/paragonie-scott/gists{/gist_id}","starred_url":"https://api.github.com/users/paragonie-scott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paragonie-scott/subscriptions","organizations_url":"https://api.github.com/users/paragonie-scott/orgs","repos_url":"https://api.github.com/users/paragonie-scott/repos","events_url":"https://api.github.com/users/paragonie-scott/events{/privacy}","received_events_url":"https://api.github.com/users/paragonie-scott/received_events","type":"User","site_admin":false},"created_at":"2015-10-19T16:35:58Z","updated_at":"2015-10-19T16:35:58Z","body":"1. Barring a memory corruption vulnerability that clobbers the zval, yes.\r\n2. Unless the exception is triggered by `key()`, it should never be leaked.\r\n3. I'd ask the folks who maintain xdebug if they have a way to look into the staticvars in a function or method, but I'm inclined to say \"no\".\r\n\r\nBonus: We could add a destructor that zeroes it from memory. :)"}}