CHURP

Even a very very cursory review of the code turns up giant red flags. As another comment noted it lacks tests, uses poor project structure and has private deps. Much more seriously, though, the encryption looks very very unsafe. The encryption uses math/rand. This alone clearly shows the authors have absolutely no clue what they are doing. The encryption itself is also very unsafe - loads of obvious side channel attacks and really far too many flaws to cover here. This isn't just a few mistakes, this is a group of people who don't know enough to do this safely. Sorry, this stuff is hard and this project doesn't come close to meeting even the lowest bar. 1: https://github.com/CHURPTeam/CHURP/blob/master/src/utils/enc...

Not sure if OP is the author but thanks for sharing. Secret management is a challenge for a lot of folks. For the authors, here are a couple of items that made it hard for me to evaluate the project: 1. This project doesn't build for me and some of the dependencies don't exist or are private repos which prevent me from building the project (https://github.com/CHURPTeam/CHURP/blob/master/src/cmd/bb.go...) 2. It's lacking godoc documentation which means it's hard for me to quickly see how the API works. As such, some of the API methods seem less than useful. For example, `(Optional) storeSecret(SK)`. What does "optional" mean? What's the return value? What's SK? (Optional) retrieveSecret() -> SK: What? I can only store a single secret? Without passing params to this, it seems so. 3. Project structure is not conventional (cmd/ inside src/) T