Backspace 1.0.3
Backspace 1.0.3
Hardening release. Adds a content security policy and a full set of security headers, validates every outbound request the server makes, moves the container to the current Node LTS, and brings the dependency tree up to date.
Nothing changes for people using the app. Self-hosters should read the operator notes at the bottom.
What changed
Security headers
Every response now carries a consistent set of security headers: frame denial, a referrer policy, MIME sniffing protection, and cross-origin values chosen so that federated avatars and attachments keep loading from peer instances.
Ownership is split deliberately. The application sends everything except HTTPS enforcement, which belongs to whatever terminates TLS, because only that layer knows HTTPS is genuinely in play.
Content security policy, in report-only mode
A policy now ships, and it blocks nothing in this release. Browsers evaluate it, report what would have been blocked, and load the resource anyway. This is on purpose: a policy that is switched straight to blocking breaks voice or embeds on somebody's deployment with nothing in the console to explain it.
The policy is built from your instance configuration at boot, so it knows your own LiveKit origin rather than a hardcoded one.
Before shipping, it was observed on two live deployments across ordinary use: messages, link embeds, file uploads, a voice join, screen sharing, and noise suppression. No violations were produced by the application. Enforcement will follow in a later release.
Outbound request validation
Every request the server makes to a user-supplied or peer-supplied address is now checked before it is sent, and checked again at every redirect hop rather than only at the start. Link previews and federated file fetches are the paths this covers.
Runtime and dependencies
The container now runs on Node 24, the active LTS. Node 20 reached end of life in April 2026, so the previous image was running an unpatched runtime.
The dependency tree moved forward across the board, including the build tooling and the desktop packaging toolchain. Known-vulnerable transitive packages dropped from 151 to 13, and each of the 13 that remain needs a major upgrade with its own compatibility work, recorded with a reason and a review date rather than silently ignored.
Continuous scanning
Static analysis, dependency scanning, secret scanning, configuration scanning, and repository posture checks now fail the build rather than merely reporting. A dynamic scan runs against a freshly built instance on every change to the main branch.
Linux: the executable inside the package is renamed
The binary inside the AppImage and the deb was previously named
@backspacedesktop, which came from the package name rather than the product
name. The packaging toolchain now rejects that name outright, so it is
Backspace from this release on. The AppImage and deb file names are unchanged.
This only matters if you launch the binary directly or script against it.
Operator notes
The compose file defaults to the latest image tag. This means docker compose pull moves you across releases, including ones that carry database migrations. If you want to stay on a specific version, set BACKSPACE_IMAGE_TAG in your .env. Backups are taken automatically before migrations run, and ./restore.sh restores them.
FEDERATION_ALLOW_PRIVATE_PEERS is new. Outbound request validation refuses to connect to private network addresses by default. If you peer instances across a LAN or a VPN, set this to true. Leave it off on anything reachable from the public internet.
If you deploy with deploy.sh, your Caddyfile is not overwritten, by design, since deployed hosts often carry extra site blocks. That also means changes to the bundled Caddyfile do not reach you automatically, so HTTPS enforcement headers are yours to set on your own proxy.
Downloads
| Platform | File |
|---|---|
| Windows (x64 + arm64) | Backspace-1.0.3.exe |
| macOS Apple Silicon | Backspace-1.0.3-arm64.dmg |
| macOS Intel | Backspace-1.0.3-x64.dmg |
| Linux x64 | Backspace-1.0.3-x86_64.AppImage / Backspace-1.0.3-amd64.deb |
| Linux arm64 | Backspace-1.0.3-arm64.AppImage / Backspace-1.0.3-arm64.deb |
macOS first launch
The app is signed but not notarized, so Gatekeeper stops the first launch. You only need to do this once.
macOS 15 and later: open the app, dismiss the warning, then go to System Settings, Privacy & Security, and press Open Anyway.
macOS 14 and earlier: right-click the app, choose Open, then Open again.
Auto-update still does not work on macOS, so check the releases page for new versions. Windows and Linux AppImage builds update automatically.
Known, not fixed here
Voice presence updates are still sent to the whole space, while the initial voice state snapshot is correctly filtered by channel visibility. A member who cannot see a voice channel gets a filtered list on connect and then sees that channel's join and leave traffic.
Logging in directly at a remote instance still forwards your password to your home instance. That path is what makes direct remote login work, so removing it needs its own design. If you have connected to an instance you do not trust, change your home password.
The published container image is scanned on every publish, and that scan reports rather than blocks. It carries a backlog of fixable findings in third-party packages that needs its own pass, and blocking on it today would stop security fixes from shipping at all.