From 29222536ecea62122bcd234212f80ced71b1b5dc Mon Sep 17 00:00:00 2001
From: Ardis Lu <ardisglu@gmail.com>
Date: Wed, 17 Jun 2026 23:18:31 -0700
Subject: [PATCH] Reset `prf` on incomplete request

---
 src/getPrf.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/getPrf.js b/src/getPrf.js
index caa5257..264fe3c 100644
--- a/src/getPrf.js
+++ b/src/getPrf.js
@@ -153,6 +153,7 @@ export async function getPrf(options = {}) {
       });
       request.on('end', () => {
         if (offset !== 32) { // Not all 32 PRF bytes were from passkey
+          prf.fill(0);
           response.writeHead(400).end();
           return;
         }
-- 
2.47.3