KeepKey Vault v1.2.3

What's New in v1.2.3

Bug Fixes

• OOB reboot messaging: Bootloader flash now shows "Device is rebooting..." with spinner (auto-reboot, no user action needed). Firmware flash keeps the explicit "disconnect and reconnect" prompt. Previously both showed identical text, confusing users during setup.
• Strict chainId validation: Rejects malformed input ("1abc", "1.5", "") instead of silently coercing to wrong network.

Security Hardening

• Timing-safe API key validation: Constant-time comparison prevents timing-based key guessing.
• Audit log sanitization: Signing payloads (signatures, transaction data, typed data) are redacted from REST API audit logs. Deep recursion catches nested fields like signDoc.msgs.
• localStorage crash guard: i18n initialization no longer crashes in private browsing mode.

Build & Test

• make build now includes zcash-cli binary (was missing).
• make test-unit now runs engine-state-machine.test.ts and wizard-messaging.test.ts alongside swap-parsing tests.

---

Downloads

Platform	File	SHA-256
macOS (Apple Silicon)	KeepKey-Vault-1.2.3-arm64.dmg	29eeaa85351cc33dc453f793bfa6072512eebf4efdaf99653542fc47aac56a06
Windows (x64)	KeepKey-Vault-1.2.3-win-x64-setup.exe	See SHA256SUMS.txt
Linux (x64)	KeepKey-Vault-x86_64.AppImage	See SHA256SUMS.txt

To verify: shasum -a 256 <filename>

What's Changed

• release: v1.2.1 — pre-release update channel by @BitHighlander in #26
• fix: bootloader OOB prompt says 'rebooting' instead of 'disconnect and reconnect' by @BitHighlander in #28
• feat: Windows splash screen, stable channel, installer branding by @BitHighlander in #27
• feat: developer center docs page + swagger fix by @BitHighlander in #29
• fix: PIN overlay hidden behind signing approval during API signing by @BitHighlander in #30
• fix: Windows auto-update — download setup exe directly by @BitHighlander in #32
• fix: differentiate bootloader vs firmware reboot messaging by @BitHighlander in #33

Full Changelog: v1.2.1...v1.2.3

What's Changed

• release: v1.2.1 — pre-release update channel by @BitHighlander in #26
• fix: bootloader OOB prompt says 'rebooting' instead of 'disconnect and reconnect' by @BitHighlander in #28
• feat: Windows splash screen, stable channel, installer branding by @BitHighlander in #27
• feat: developer center docs page + swagger fix by @BitHighlander in #29
• fix: PIN overlay hidden behind signing approval during API signing by @BitHighlander in #30
• fix: Windows auto-update — download setup exe directly by @BitHighlander in #32
• fix: differentiate bootloader vs firmware reboot messaging by @BitHighlander in #33

Full Changelog: v1.2.1...v1.2.3