Release v2.4.1 · makepkg/SecureGen

SecureGen v2.4.1

Hidden Space files no longer orphaned on removal — Space B's private files (keys, passwords, WiFi, sessions, etc.) were being addressed with the wrong device key during removal and were silently left on the filesystem despite the device reporting a full wipe. Removal now correctly uses Space B's own key, obtained non-destructively via an on-device PIN check.
Startup PIN can no longer be disabled while Hidden Space is active — disabling used to attempt an (incorrectly keyed) automatic wipe of Hidden Space; it's now hard-blocked at every layer until Hidden Space is explicitly removed via its own on-device PIN B confirmation.
Hidden Space can no longer be created without Startup PIN enabled — creating Hidden Space on an unencrypted device key silently corrupted the key file; blocked with a guard at every entry point, including inside the core function itself.
Duress PIN now depends on Startup PIN — Duress PIN can only ever be triggered from the Startup PIN lock screen, so it can no longer be configured while Startup PIN is disabled, and is automatically removed if Startup PIN is turned off.
PIN length disclosure mitigation — PIN entry mask now displays a fixed-width 10-slot mask regardless of configured PIN length, preventing visual shoulder-surfing.

Send Login Before Password — device can type a login/username first, then Tab or Enter, wait a configurable delay, then the password. Configurable per entry.
Wildcard Passwords — on-demand, session-only random passwords (3–50 chars) that never leave the device; ideal for HID-only accounts. Singleton constraint, cannot be copied or exported.
Secure Import/Export Mode — bulk import/export now runs through an isolated, closed-AP session instead of an always-on API toggle, reducing attack surface for this sensitive operation.

TOTP/password reorder consistency — reordering and import now re-sort the in-memory list immediately, without requiring a reboot.
Password export buffer overflow — export buffer increased from 2KB to 16KB, supporting up to ~100 password entries instead of failing silently past ~15–20.
False RTC "drifted" status — fixed a timezone double-application bug that caused a false drift warning whenever the device timezone was unset or didn't match the browser's.
Password screen redraw after QR code dismissal — displaying a TOTP QR code while in Password mode used to leave the screen blank after the code auto-hid or was dismissed.

BREAKING: removed the legacy 5-minute import/export toggle and its six endpoints; all import/export now goes exclusively through Secure Import/Export Mode.
Encrypted transport encoding — secure envelope fields now use base64 instead of hex, ~30% smaller payloads. Protocol-breaking; existing sessions are invalidated on upgrade.
Heap pressure reduction — key/password getters now return by reference instead of copying on every call, cutting repeated allocations from the main TOTP display loop.

Corrected Hidden Space and Duress PIN behavior across SECURITY_OVERVIEW.md, security_model.md, ENDPOINTS.md, and both user guides (EN/RU), including the website's standalone mirrors.
Documented the new /api/hidden_space deferred on-device confirmation flow (prompt_on_device response).

Flash online: https://makepkg.github.io/SecureGen/flash
User Guide: https://makepkg.github.io/SecureGen/guide

File	SHA-256
firmware-esp32.bin	762408509d9028de1271100ea6d73bde69744006ed75c0cf219399cc30d66364
firmware-s3.bin	423ce9dc09ec50f73dadcb0cd992f0f1f0d986d1c50d606dd32d8e977759539a
merged-firmware-esp32.bin	f287c94bc61cfb242968e8bf33588ac869e699195674a2736626618a26a324dc
merged-firmware-s3.bin	9c7bda157c850f9453024214ac6ac4d72957d814af3af2c12ee3e337c401769a