Skip to content

Perchnote 0.1.2

Choose a tag to compare

View all tags
@GurtekS GurtekS released this 27 May 22:13
v0.1.2
c5d1c56

First downloadable release. v0.1.0 and v0.1.1 were withdrawn — both shipped builds with data-leakage findings that this release closes.

🔒 What was fixed (vs. the withdrawn v0.1.0 / v0.1.1)

🔴 Transcript text no longer logged

The whisper transcription code was logging every transcribed segment in full at default info! level — meeting transcripts ended up in stdout / Console.app / log stream, visible to any local tool with log-reading access and capturable in screen recordings or crash dumps. Now only segment length is logged.

🟡 OAuth flows use state + PKCE

Google and Microsoft OAuth flows now generate a fresh state (RFC 6749 §10.12) and S256 code_challenge (RFC 7636) per attempt. The callback verifies state and the token exchange sends the code_verifier. Closes a localhost OAuth-CSRF window that could have logged a user into an attacker's calendar (useful for phishing via planted invites).

🟡 Meeting titles + recording paths no longer logged

Notification-sent log dropped meeting.title (often contains client names / project codes). WAV-repair log dropped the recording path.

🟡 Asset protocol scope narrowed

tauri.conf.json previously had $APPDATA/** exposed via asset://, which would have reached the SQLite database (notes, transcripts). Now scoped to $APPDATA/recordings/** only — matches actual frontend use (the audio player and transcript drawer only ever request recording paths).

🟢 Build paths stripped from binary

Prior builds embedded /Users/admin/.cargo/registry/... strings via Rust's file!() macro in dependency panic messages. The Cargo config now sets --remap-path-prefix=/Users/admin=/build and strip = "symbols" on the release profile. The shipped binary contains no host-machine paths.

🧪 Testing

170 Rust tests pass, including 9 new tests on the pkce module (uniqueness, code_challenge = base64url(SHA256(code_verifier)), callback parsing with URL decoding, rejection of missing/error responses). 173 frontend tests pass.

📥 Install

  1. Download Perchnote_0.1.2_aarch64.dmg below.

  2. Open the DMG and drag Perchnote to /Applications.

  3. First launch: right-click the app in /Applications → Open, then confirm the Gatekeeper warning. The build is still unsigned (signing/notarization is roadmap).

    Prefer a one-shot fix:

    xattr -dr com.apple.quarantine /Applications/Perchnote.app

Verify the download

shasum -a 256 -c Perchnote_0.1.2_aarch64.dmg.sha256

Expected: 511d08194f00eff4f1eede87349c817a7da05cb9e9c1a2951a7d6335013a6e8a

⬆️ If you downloaded v0.1.0 or v0.1.1 before they were withdrawn

Drag the new app over the old one in /Applications. Your OAuth tokens, recordings, transcripts, notes, and Keychain entries are untouched — patches are backwards-compatible. No re-auth required (refresh tokens still work; PKCE/state only apply to new OAuth flows).

📋 Requirements

macOS 14+, Apple silicon (aarch64). Intel users should build from source.

Issues: https://github.com/GurtekS/perchnote/issues

Assets 4
Loading