sepot

Files

T

Julius Joska 717aeed4ff fix(security): treat a new identity key as a message request, never as a known contact

A stranger could pick the display name of an existing contact ("Mom")
and appear as that contact. Messages from a key that is not in the
contact list now open a message request labelled "(unknown)": no
replies, read receipts, typing indicators, calls or name in
notifications until the user accepts it and names the contact
themselves. Names that look like an existing contact (case, diacritics,
Cyrillic/Greek homoglyphs, invisible characters) also show a warning in
the real contact's chat.

When the relay account of a known contact shows up with a different
key, the chat shows "safety number changed", verification is cleared
and the session that now belongs to the other key is dropped before
sending, so a reply never goes to the new key.

2026-10-23 10:50:42 +02:00

auth

fix(security): require a fresh PIN or biometric check for sensitive actions

2026-10-23 10:50:16 +02:00

calls

fix(app): accept incoming calls, restore from recovery phrase, duress session isolation, message loss

2026-10-09 14:02:33 +02:00

chat_list

fix(security): treat a new identity key as a message request, never as a known contact

2026-10-23 10:50:42 +02:00

contacts

fix(security): treat a new identity key as a message request, never as a known contact