From e6ff26e06b6685657f1b7fc18177c6e304a1293a Mon Sep 17 00:00:00 2001
From: Ardis Lu <ardisglu@gmail.com>
Date: Wed, 17 Jun 2026 23:05:03 -0700
Subject: [PATCH] Move prf zeroing logic inside `finally`

This approach is more semantically aligned with what is meant to happen (wipe `prf` after it is broadcast, regardless of success or fail), and potentially better scheduling (previous approach allowed theoretical promises in the microtask queue injected after the `fetch` but before yielding to main thread?).
---
 src/getPrf.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/getPrf.html b/src/getPrf.html
index 9aac142..2fba2ea 100644
--- a/src/getPrf.html
+++ b/src/getPrf.html
@@ -98,8 +98,9 @@
           'Envpass-Challenge': challenge
         },
         body: prf
+      }).finally(() => {
+        prf.fill(0);
       });
-      prf.fill(0);
       if (response.status === 200) {
         p.textContent = 'Successfully sent passkey. You may close this window now.';
         clearTimeout(timeoutId);
-- 
2.47.3