DocSafe v1.0.8 — partial export + recovery codes

DocSafe v1.0.8 — partial export + recovery codes 🗝️

Two new features, both security-reviewed.

Export selected folders to a new vault

In multi-select, pick one or more folders (and/or documents) and export them into a
brand-new .dsvault file with its own new password. The new vault gets a fresh
encryption key and re-encrypted copies of everything you selected; your current vault is
untouched. Useful for splitting off a subset to share or archive separately. Gated behind
a biometric/PIN confirmation.

Recovery codes

For any vault you can now generate ~10 one-time recovery codes. Save them somewhere
safe and separate from your device. If you ever have the vault file but forget its
password, enter a code at import time to open it (then set a new password).

• Each code is single-use — it's struck from the file once used.
• Changing the master password cancels all codes. Generating a new set replaces the old.
• Codes are high-entropy and protected with Argon2id; they're shown only once.
• Generating codes requires unlocking + a fresh biometric/PIN confirmation.

Find both under the vault's ⋮ menu (recovery codes) and the selection bar (export),
and use "Use a recovery code instead" on the import screen.

Still fully offline, no internet permission. Existing vaults are unaffected (the
recovery block is added only when you generate codes).

Install

Requires Android 8.0 (API 26)+. Download docsafe-1.0.8.apk below.

Verify (reproducible build, no network access)

git clone https://github.com/dmitryduka/docsafe && cd docsafe
git checkout v1.0.8
./gradlew :app:assembleRelease
tools/verify-apk.sh /path/to/docsafe-1.0.8.apk     # expects MATCH ✅
aapt dump permissions docsafe-1.0.8.apk            # no android.permission.INTERNET

• APK SHA-256: 1f25347a6caf9b2fa680a84c769929f3a938e70e6974e181b3b38c1b58a37b5e
• Signing certificate SHA-256: ea684abfed2dd5f56f6da2832f8b3f6898c3317597f8c71ac554e49a5a936653

See VERIFYING.md.