All releases

Version 0.59.4

2026-08-18 23:52:33 UTC

HotfixBeta

Security

1
  • Key material is now wiped from the 64 MB of working memory that turning your account code into keys uses up.

    Turning an account code into keys is deliberately slow and deliberately memory-hungry — it fills 64 MB and works through it three times, so that guessing codes is expensive. That workspace was then handed back without being cleared, and what it held was not scratch: the last part of it is one hash away from the value every key in the account comes from, and in a browser handed-back memory is not returned to the machine but stays inside the page for as long as the tab is open. It is now overwritten with zeroes before it is handed back, and nothing you do changes and no key changes: the same account code still produces exactly the same keys, which the conformance suite checks byte for byte. This does not make keys unreadable while they are in use; what it removes is the copy that used to sit around afterwards.

NMTS — cloud storage that encrypts in your browser