You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Addresses the three items raised in the Google Play review. No functional or data-format
changes: vaults, the file format and the crypto are untouched, and this updates any
existing 1.0.14 install in place.
Edge-to-edge display (Android 15+)
Android 15 forces edge-to-edge for apps targeting SDK 35+, which means apps have to keep
their own content clear of the system bars.
The onboarding and unlock screens shared a layout that consumed no window insets at
all — the icon and title rendered under the status bar and the buttons under the
gesture pill. They now apply safeDrawingPadding().
The OCR hint bar in the image viewer sits in the ScaffoldbottomBar slot, which the
Scaffold does not inset, so it now pads itself against the navigation bar.
The six Scaffold screens use contentWindowInsets = WindowInsets.safeDrawing. The
default (systemBars) ignores the display cutout — which now matters in landscape — and
ignores the keyboard.
No more deprecated window APIs
Window.setStatusBarColor, Window.setNavigationBarColor and LAYOUT_IN_DISPLAY_CUTOUT_MODE_SHORT_EDGES are all no-ops on Android 15+. They came from
androidx's enableEdgeToEdge(), so that call is gone, replaced with WindowCompat.setDecorFitsSystemWindows(window, false). The transparent bars it set up for
Android 14 and below are declared in the theme instead, where they are simply not consulted
on 15+. The release DEX now contains zero references to all three.
Large-screen / orientation freedom (Android 16)
ML Kit's document-scanner delegate activity hardcodes screenOrientation="portrait", which
Android 16 ignores on large screens and which Play attributes to the app. It is overridden
to unspecified, keeping the library's no-recreation guarantee via configChanges.
Also bumps play-services-mlkit-document-scanner 16.0.0-beta1 → 16.0.0.
Verified
On an Android 16 (API 36) emulator: the auth screen viewport is inset 63px top and bottom,
shrinks correctly when the keyboard opens, the top app bar and FAB clear the system bars,
and the app relayouts in landscape without crashing.
The app's package identity is now com.dmitryduka.docsafe (previously app.docsafe).
The display name is still DocSafe and there are no functional changes.
⚠️ Important: this is a new app identity
Android identifies apps by their application ID, so this build is treated as a separate app:
It installs alongside any existing app.docsafe DocSafe rather than updating it, and starts
with empty private storage — your existing vaults do not carry over automatically.
To migrate: in the old app, Save vault to device (⋮ menu) for each vault, install this
build, then Import each .dsvault. Once verified, uninstall the old app.docsafe app.
On Google Play this would be a new listing, not an update to an existing one.
Minor correctness fix to the per-document thumbnail size added in 1.0.12: the setting is now
keyed by vault + document, not document alone. Document ids are unique within a vault, but
importing a copy/backup of a vault preserves its document ids, so two vaults on one device could
otherwise share the same setting.
DocSafe v1.0.12 — version footer + remembered thumbnail size
App version in Settings. The current version is shown at the bottom of the Settings
screen.
Per-document thumbnail size. The S/M/L thumbnail size you pick in a document is now
remembered for that document and restored next time you open it.
(Considered "share an entire document/folder as files" but did not add it — sharing many
files at once is unreliable, and exporting a folder to a new .dsvault already covers it.
See the repo notes.)
The feature couldn't deliver its core promise. "Single-use" can't be enforced for an
offline vault file — the used-code strike only landed on a throwaway copy made during
import, never on the file you keep — so a code could be reused indefinitely by importing
the same file again. That made recovery codes effectively just extra always-valid
passwords stored inside the vault, no better than backing up your password, while adding
a crash and confusing behavior. So they're gone.
No more recovery-codes menu item, generation dialog, or "use a recovery code" import option.
Vault files that happen to contain a recovery block (made with 1.0.8–1.0.10) still open
normally with their password — the block is simply ignored.
Export to new vault (export selected folders into a new password-protected .dsvault)
is unchanged and still available.
If you forget a vault's password there is, by design, no backdoor — keep your master
password backed up somewhere safe.
Fixes a crash and clarifies how recovery codes work.
Crash fix
Importing a vault with a recovery code could crash if the file didn't actually contain
recovery codes (or on a memory-constrained device). The recovery-import path now fails
closed — it shows a clean "couldn't recover" message instead of crashing — and no longer
leaks a file handle on failed attempts.
Important: how recovery codes actually work
Recovery codes are stored inside the vault file. They let you open a backup of that
file by entering a code instead of the password. That means:
Generate the recovery codes for a vault.
Then back up the vault (⋮ → Save vault to device / Share vault).
Recovery works by re-importing that backup and choosing "Use a recovery code".
A backup made before you generated the codes will not accept them (the codes aren't in
it). The recovery-codes dialog now explains this.
No format/crypto changes — codes from 1.0.8 still work with a file that contains them.
When importing a vault from the Vaults → Import screen (the normal in-app path once
you're set up) and entering a recovery code, DocSafe treated it as a password and
rejected it with "wrong password / not a valid vault". The "use a recovery code instead"
option was only present on the onboarding/open-with import screen, not the in-app one.
Fix
The in-app import dialog now has the same "Use a recovery code instead" toggle, so a
recovery code opens the vault correctly regardless of how you start the import.
No format or crypto changes; recovery codes generated in 1.0.8 keep working.
In multi-select, pick one or more folders (and/or documents) and export them into a
brand-new .dsvault file with its own new password. The new vault gets a fresh
encryption key and re-encrypted copies of everything you selected; your current vault is
untouched. Useful for splitting off a subset to share or archive separately. Gated behind
a biometric/PIN confirmation.
Recovery codes
For any vault you can now generate ~10 one-time recovery codes. Save them somewhere
safe and separate from your device. If you ever have the vault file but forget its
password, enter a code at import time to open it (then set a new password).
Each code is single-use — it's struck from the file once used.
Changing the master password cancels all codes. Generating a new set replaces the old.
Codes are high-entropy and protected with Argon2id; they're shown only once.
Generating codes requires unlocking + a fresh biometric/PIN confirmation.
Find both under the vault's ⋮ menu (recovery codes) and the selection bar (export),
and use "Use a recovery code instead" on the import screen.
Still fully offline, no internet permission. Existing vaults are unaffected (the
recovery block is added only when you generate codes).
A security-focused release (from a full review of the project). No format changes;
existing vaults are unaffected.
Hardening
Screen privacy (FLAG_SECURE). Decrypted documents no longer appear in
screenshots, the recent-apps thumbnail, or screen recording/casting.
Plaintext cache wiped on lock. Files decrypted to share/open externally are
now cleared when the vault locks, instead of lingering until the next share.
Sensitive clipboard. Copied files/values are flagged sensitive so the OS keeps
them out of clipboard previews/history (Android 13+).
Step-up confirmation. Removing a vault, saving/sharing a whole vault, disabling
biometric/PIN, and changing the PIN now require a fresh biometric/PIN check — being
already unlocked is no longer enough.
Stronger key storage. The wrapping key uses a StrongBox secure element where
available (graceful fallback otherwise) and is usable only while the device is unlocked.
Robust auto-lock. A cancelled share can no longer leave the vault un-lockable in
the background.
Tamper resistance. Rejects absurd KDF parameters and out-of-range lengths from a
malformed/crafted .dsvault, and treats all decryption failures uniformly.
Under the hood
Removed duplicated export/traversal code, fixed a couple of concurrency races
(compaction vs reads, vault-state transitions), and localized the remaining UI strings
across all 17 languages.
Merging no longer duplicates folders. When you merge (or copy) into a
vault that already has a folder with the same name, the contents are now unioned into the single existing folder — recursively for subfolders —
instead of creating a second folder of the same name. If a document then
collides by name inside that folder, the incoming copy is renamed " from " so nothing is overwritten or silently merged.
New and imported vaults open immediately. Creating or importing a vault
now drops you straight into it. Previously it became the active vault but you
had to press Back to actually enter it.
The title shows the current vault's name. The browser top bar and the
root breadcrumb now display the active vault's name instead of a fixed
"My Vault", so it's always clear which vault you're in.
Localized in all 17 languages. Still fully offline, no internet permission.
