v1.15.1 🔥 Ignition

🎯 Headline — The Seed Generator Stands on Its Own

The seed-phrase generator is now a small, complete tool: generate a phrase, scan it straight into a hardware wallet, and confirm on the device's own screen that it loaded the same phrase — without touching the rest of the app. Alongside it, three fixes found by running the inheritance plan builder end-to-end in the real desktop app, and a round of dependency work that clears every outstanding security advisory. No change to the Qard format — everything you have already made restores exactly as before.

✨ What's New

Master fingerprint and SeedQR in the generator

Three additions turn the generator into something you can finish a job with:

• The master fingerprint now appears beside the validity badge. It is a short code your hardware wallet displays too, so after importing a phrase you can check both show the same thing — proof the device holds the phrase you meant to give it, before you send any money to it.
• A SeedQR panel, opened from the QR icon, offers both the Standard and Compact formats that hardware wallets scan. It stays blurred behind its own reveal control, and the fingerprint is repeated underneath as a "verify after import" reminder.
• Everything sensitive re-hides automatically whenever you generate a new phrase, so a fresh phrase is never left exposed on screen.

No new cryptography was written for any of it — the fingerprint and both QR formats use the very same code the restore screen already shipped. Web and desktop both pick this up.

Inheritance plan fixes (desktop)

Running the plan builder end-to-end in the real desktop app — create, encrypt, export, decrypt, edit, re-encrypt — turned up three things that testing the logic alone had missed:

• The "file saved" confirmation now names the file you chose in the save dialog, rather than the name the app had suggested.
• Exporting a plan prepared by someone whose name ends in a bracket or other punctuation no longer produces an odd filename; the plan file and the PDF now agree on how that name is cleaned up.
• The "Recreating the Wallets" appendix is no longer dropped from the exported PDF when the asset inventory is left empty. Every plan's own instructions point heirs at that appendix, so a plan that omitted it was sending them to a section that wasn't there.

🧹 Under the Hood

• Next.js 16.2.12 → 16.3.3. This closes two Critical advisories: an unauthenticated remote-code-execution flaw on Windows-hosted servers, and another in the image-optimization endpoint. Neither was reachable in seQRets — the web app is a static export with no server to attack, and the vulnerable image endpoint is not present in the built output at all. It was updated anyway on principle: a custody product should not sit on a version with known Critical flaws, reachable or not.
• Icon library upgrade. Moving to lucide-react 1.x removed its brand icons, so the GitHub mark on the About page is now GitHub's own official octicon (MIT-licensed). All 74 icons across the app were checked against the new version; that was the only one affected.
• Three more advisories closed — in a ZIP-reading function the app never calls, and in two build-time tools that never reach your machine. Each was reviewed individually rather than bulk-upgraded, and none touched encryption code.

🤝 Compatibility

• ✅ All existing Qards — share format, integrity hash, and every cryptographic primitive are unchanged. Restores are unaffected.
• ✅ All existing inheritance plans — decrypt and open exactly as before; nothing about the plan format changed in this release.
• ✅ recover.html — no changes required.
• ✅ Vault files and smart cards — unchanged.

🛡️ Security Note

No cryptographic primitive changed in this release. Argon2id, XChaCha20-Poly1305, Shamir's Secret Sharing and SHA-256 are untouched, and seed phrases, passwords, keyfiles, salts and nonces all continue to draw full-strength randomness from the operating system with no fallback path.

The five dependency advisories closed here were each checked for whether they could actually be reached from seQRets, and none could. They were updated as hygiene, not because earlier versions were unsafe.

The plan PDF remains deliberately unencrypted — that is its purpose, since it is the copy heirs must be able to read with no software and no password — and the app warns about this on every export.

The independent code review in docs/SECURITY_ANALYSIS.md was conducted at v1.14.3; the changes in v1.15.0 and v1.15.1 have not been independently reviewed.