Architecture Review: Buffer hygiene post-KDF and streaming boundaries for large payloads (>2 GB) #3

Hi @FileShot / Brendan,

I came across FileShotZKE while exploring browser-native zero-knowledge implementations. The architecture here is exceptionally clean—especially stripping external dependencies by running an inline pure-JS Argon2id implementation and using URL fragment boundaries to isolate keys from the transport layer.

I wanted to open a brief discussion around two architectural boundaries regarding client-side memory hygiene and payload sizing:

1. In-Memory Sanitization of Derived Key Material

While JavaScript relies on non-deterministic garbage collection (V8/SpiderMonkey), derived key buffers and plaintext passwords held in Uint8Array can linger in memory pages.

• Have you evaluated explicitly calling .fill(0) on intermediate typed arrays immediately after crypto.subtle.importKey() and Argon2id derivation?
• While it doesn't guarantee instant OS-level reclamation due to runtime string interning or GC behavior, zeroing out typed array buffers significantly shortens the exposure window against memory scraping or heap inspection.

2. Sizing Boundaries on Large Files (V8 Heap Limits)

I noticed FileShot supports large files (up to 10 GB+). In browser environments, passing standard Blob/ArrayBuffer payloads into crypto.subtle.encrypt() directly in memory will typically hit browser heap limits (around 2 GB in Chromium/Firefox).

• Are you planning to expose a chunked streaming interface (e.g., Web Streams API with incremental AEAD frames/monotonic IVs) in this library to handle large file pipelines without full in-memory buffering?

In my own work architecting local-first encryption tools in Rust (Ombracrypt), solving deterministic memory scrubbing (via the zeroize crate) and safe chunked payload processing were major milestones in hardening our threat model. It’s always great to see zero-knowledge projects taking client-side cryptography seriously.

Curious to hear your thoughts on buffer scrubbing and streaming within your current browser-only threat model!

Best regards,
Abhishek