| Version | Supported |
|---|---|
| 1.1.x | ✅ |
| 1.0.x | ✅ Security fixes |
Please do not open a public GitHub issue for security vulnerabilities.
Use GitHub's private vulnerability reporting.
You'll receive a response within 72 hours. If the issue is confirmed, a patch will be released as soon as possible and you'll be credited in the changelog.
Recall is a local-first application. Network access is limited to:
- Auto-update checks via GitHub Releases (signed ed25519, optional)
- Optional desktop notifications
- E2E encrypted sync relay (opt-in): pushes/pulls AES-256-GCM encrypted blobs to a Cloudflare Worker. The relay never sees plaintext or encryption keys. Users can self-host the relay. See sync-relay/README.md.
- JavaScript/TypeScript: Dependabot +
pnpm audit - Rust:
cargo auditruns on every CI push/PR (ignore justifications insrc-tauri/.cargo/audit.toml) - CodeQL: GitHub CodeQL analyzes both JS/TS and Rust on every push
As of the latest release, there are no known unpatched vulnerabilities in our direct dependencies.
Some transitive dependencies may have advisories flagged by cargo audit or pnpm audit. These are tracked and updated as upstream fixes become available. See the Security Advisories page for detailed information.
- All dependencies are pinned to compatible semver ranges
pnpm-lock.yamlis committed to ensure reproducible builds- Dependabot is configured for automated security updates
Every release includes:
- SHA256SUMS - verify download integrity with
sha256sum -c SHA256SUMS - Signed updater bundles - Tauri updater verifies ed25519 signatures before installing
Binaries are not OS-signed. This means:
SmartScreen may warn "Windows protected your PC" on first run. To proceed:
- Click "More info"
- Click "Run anyway"
To verify authenticity, check the SHA256SUMS file against your download.
Gatekeeper may block the app with "Recall cannot be opened because the developer cannot be verified." To proceed:
- Right-click the app → Open (instead of double-click)
- Click Open in the dialog
Alternatively, remove the quarantine attribute:
xattr -cr /Applications/Recall.appAuthenticode (Windows) and notarization (macOS) require paid certificates. This is tracked for future releases but not currently implemented.