A correctness and security release, produced by agentic coding with Claude Opus 5: a full code review, then an adversarial security pass over its own work. No new features. Two of these fixes address silent data loss during ordinary editing, so updating is recommended. 518 tests grew to 613. The .scrb format and settings schema are unchanged, so existing files open untouched.
Important fixes
Text typed while a save was in progress was discarded. A save marked the note clean against its live content rather than the bytes actually written, so anything typed during the write (an encrypted save takes well over 100ms, and auto-save repeats every 30 seconds) was recorded as saved without ever reaching disk. The unsaved marker cleared and the quit prompt saw nothing pending. Saves now record what they wrote, and a note edited mid-write stays unsaved until the next save persists it.
Encrypting or converting a file could destroy an unrelated file. Ctrl+E and the plain/rich toggle change a file's extension. The new destination was written with no prompt and no backup, replacing whatever was already there, and then the source was deleted. These saves now ask before replacing an existing file, and decline rather than overwrite if the prompt cannot be shown.
Encrypting a file left the original recoverable. The plaintext was deleted but not erased, so it remained readable in free space. It is now overwritten before removal, along with any stray backup left by an interrupted save. Recovery is still possible on SSDs, snapshotted volumes and synced folders: see the threat model in README.md.
Highlights
- Files changed on disk by another program are no longer overwritten without warning. Background saves refuse and leave the note unsaved; a manual save asks first
- Save As refuses a file another tab already has open, and naming an untitled tab asks before replacing an existing file
- Locking a tab now also clears its undo history, the decoded images held in memory, and the clipboard when it holds text copied from that note
- Changing a password no longer applies the new password when the re-encrypt fails
- A note marked encrypted over a plaintext file can no longer be locked, which previously left a lock screen that could never be unlocked
- The password strength meter accounts for common passwords, keyboard runs and repeated characters, so some passwords it rated Strong now rate lower
- Colored and highlighted text no longer gains a stray space on every save to RTF, and the colors are now exported rather than dropped
- Whole-word search no longer skips matches, and no longer corrupts accented and non-Latin words on Replace All
- Non-UTF-8 text files (.log, .csv, .ini from older Windows tools) open instead of being refused
- Reads are capped at 64 MB, and hostile .rtf, table and image payloads are bounded
Full details in the CHANGELOG. The two save bugs are written up at greater length on the blog.
Verifying this build
Releases are not code-signed, so Windows shows an unsigned-app warning. This release publishes a build provenance attestation, so the zip can be tied to the workflow run and commit that produced it:
gh attestation verify scrib-desktop-v1.10.0-windows-x64.zip --repo beeswaxpat/scrib-desktop
The attached SHA-256 is generated by the same workflow that builds the zip, so it detects transfer corruption but is not evidence of authenticity.
Download
scrib-desktop-v1.10.0-windows-x64.zip (sha256 checksum attached). Unzip and run scrib_desktop.exe. Windows 10 or later. Your existing files and settings are untouched.