Skip to content

DocSafe v1.0.7 — security hardening

Choose a tag to compare

View all tags
@dmitryduka dmitryduka released this 14 Jun 08:37
· 10 commits to main since this release
v1.0.7
b8d9d12

DocSafe v1.0.7 — security hardening 🔒

A security-focused release (from a full review of the project). No format changes;
existing vaults are unaffected.

Hardening

  • Screen privacy (FLAG_SECURE). Decrypted documents no longer appear in
    screenshots, the recent-apps thumbnail, or screen recording/casting.
  • Plaintext cache wiped on lock. Files decrypted to share/open externally are
    now cleared when the vault locks, instead of lingering until the next share.
  • Sensitive clipboard. Copied files/values are flagged sensitive so the OS keeps
    them out of clipboard previews/history (Android 13+).
  • Step-up confirmation. Removing a vault, saving/sharing a whole vault, disabling
    biometric/PIN, and changing the PIN now require a fresh biometric/PIN check — being
    already unlocked is no longer enough.
  • Stronger key storage. The wrapping key uses a StrongBox secure element where
    available (graceful fallback otherwise) and is usable only while the device is unlocked.
  • Robust auto-lock. A cancelled share can no longer leave the vault un-lockable in
    the background.
  • Tamper resistance. Rejects absurd KDF parameters and out-of-range lengths from a
    malformed/crafted .dsvault, and treats all decryption failures uniformly.

Under the hood

Removed duplicated export/traversal code, fixed a couple of concurrency races
(compaction vs reads, vault-state transitions), and localized the remaining UI strings
across all 17 languages.

Still fully offline, no internet permission.

Install

Requires Android 8.0 (API 26)+. Download docsafe-1.0.7.apk below.

Verify (reproducible build, no network access)

git clone https://github.com/dmitryduka/docsafe && cd docsafe
git checkout v1.0.7
./gradlew :app:assembleRelease
tools/verify-apk.sh /path/to/docsafe-1.0.7.apk     # expects MATCH ✅
aapt dump permissions docsafe-1.0.7.apk            # no android.permission.INTERNET
  • APK SHA-256: 7d7ef1085124d7126e4b96708127bad14938201c4729755def2fb27352f74e5b
  • Signing certificate SHA-256: ea684abfed2dd5f56f6da2832f8b3f6898c3317597f8c71ac554e49a5a936653

See VERIFYING.md.

Assets 4
Loading