Julius Joska
2f6b542f24
An unlocked phone was enough to read the 24-word recovery phrase. The phrase, backup export and import, the duress PIN, a longer auto-lock, turning off screen security, enabling biometrics and deleting the account now ask for the PIN (or biometrics with biometricOnly) every time. The duress session never shows the phrase. PIN checks outside the lock screen count towards the same failure throttle.
Šepot — Flutter client
The Šepot mobile client. See the repository README for the project overview, threat model, and license.
Quick start
flutter pub get
flutter run # against the default relay
flutter build apk --release # signed release APK (see key.properties)
Layout
| Path | Contents |
|---|---|
lib/core/ |
Crypto facade, storage (SQLCipher), relay client + transport, push, services |
lib/features/ |
Screens (onboarding, chat, contacts, groups, settings, safety…) |
lib/models/ lib/providers/ |
Data models and Riverpod providers |
lib/l10n/ |
Localization (app_*.arb, generated AppLocalizations) |
test/ integration_test/ |
Unit, storage, crypto, and on-device integration tests |
Localization
Strings are defined in lib/l10n/app_cs.arb (template) and translated into
app_en/de/ru/it.arb. After editing, run flutter gen-l10n. See the root
README for how to contribute a new language.