Brow 0.2.1

[efim0v]

Brow 0.2.1 fixes a security issue in 0.2.0: it kept Claude Code access tokens in a cache file. Please update.

Security

• Usage and profile requests no longer go through the shared URL cache. Brow 0.2.0 stored each request, with the Claude Code access token in its Authorization header, and each response, with the account's email and plan, in ~/Library/Caches/dev.artemefimov.brow/Cache.db. Any process running as your user could read that file without a Keychain prompt. The tokens there are access tokens, which expire after about eight hours; refresh tokens were never stored.

• The first request after launching 0.2.1 empties that cache. To remove it right away, quit Brow and run:

  rm -rf ~/Library/Caches/dev.artemefimov.brow

Fixed

• An account Brow has no reading for yet no longer counts as 0 % used in the two readouts beside the notch and in the panel's Overall line. With a Pro account at 90 % of both limits and a Max 20x account with no reading, both readouts showed 4 %; they now show 90 %.

The changelog lists everything else since 0.2.0, mostly documentation: an FAQ, Uninstall steps, the README in Russian and Simplified Chinese, and the website.

Update

• Homebrew: brew upgrade --cask brow.
• Or download Brow.zip below, quit Brow and replace /Applications/Brow.app. The build is signed ad hoc and not notarized, so macOS blocks the first launch: open System Settings → Privacy & Security and press Open Anyway, or run xattr -dr com.apple.quarantine /Applications/Brow.app.
• A new ad hoc build can lose access to Claude Code's Keychain items. An account in that state shows a key; press it and choose Always Allow.
• To hear about the next release, use Watch → Custom → Releases on this repository.

Requires macOS 26 or later on Apple silicon and Claude Code.

Files

File	What it is
Brow.zip	The app
SHA256SUMS.txt	Checksum — verify with shasum -a 256 -c SHA256SUMS.txt

Built from tag 0.2.1. To build it yourself, see Build.

---

This discussion was created from the release Brow 0.2.1.