maximus/Simpl-Resultat
1
0
Fork 0
Code Issues 5 Pull requests Projects Releases 23 Packages Wiki Activity Actions

23 releases 52 tags

RSS feed
  • v0.7.4 cab4cc174a

    Simpl'Résultat v0.7.4
    All checks were successful
    Release / build-and-release (push) Successful in 26m7s
    Details
    Stable

    Ghost released this 2026-04-14 15:24:40 +00:00 | 169 commits to main since this release

    Changed

    • OAuth tokens are now stored in the OS keychain (Credential Manager on Windows, Secret Service on Linux) instead of a plaintext JSON file. Existing users are migrated transparently on the next sign-in refresh; the old file is zeroed and removed. A "tokens stored in plaintext fallback" banner appears in Settings if the keychain is unavailable (#66, #78, #79, #81)
    • Cached account info is now HMAC-signed with a keychain-stored key: writing subscription_status to account.json manually can no longer bypass the Premium gate (#80)
    • PIN hashing migrated from SHA-256 to Argon2id for brute-force resistance (CWE-916). Existing SHA-256 PINs are verified transparently and rehashed on next successful unlock; new PINs use Argon2id (#54)

    Security

    • Closed CWE-312 (cleartext storage of OAuth tokens), CWE-345 (missing integrity check on the subscription cache), and CWE-916 (weak PIN hashing). Legacy tokens.json and legacy unsigned account.json caches are rejected by the gating path until the next token refresh re-establishes a keychain-anchored trust (#66, #54)

    Installation

    Windows : Téléchargez le fichier .exe ci-dessous.
    Linux : Téléchargez le fichier .deb ou .AppImage ci-dessous.

    Downloads