Skip to content

Deezy v0.2.0 – Security Hardening

Choose a tag to compare

View all tags
@PierrunoYT PierrunoYT released this 21 Feb 16:01
· 193 commits to main since this release
v0.2.0
c880dd1

Security

  • Move ARL token storage from plaintext JSON to OS credential store (Windows Credential Manager / macOS Keychain / Linux Secret Service) with automatic migration
  • Obfuscate Blowfish and AES cryptographic keys at rest in the binary (XOR deobfuscation at runtime)
  • Generate real Ed25519/minisign updater signing keypair (replaces placeholder public key)
  • Sanitize lyrics HTML output to prevent XSS injection from Deezer API data
  • Add path traversal protection to theme load/save/delete operations
  • Restrict settings file permissions to 0600 on Unix to protect stored ARL token
  • Disable withGlobalTauri to prevent exposing Tauri IPC on window.__TAURI__
  • Remove all verbose debug logging that could leak sensitive settings, user IDs, or session details
  • Add CSV formula injection protection to download history export
  • Enforce minimum TLS 1.2 and HTTPS-only on the HTTP client
  • Remove overly broad process:default Tauri capability, scope to process:allow-restart only
Assets 5
Loading