Download Latest Version
v6.4.0 -- Now it reads right to left source code.zip (31.5 MB)
Get an email when there's a new version of SecureBit.chat - P2P Encrypted Messenger
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-06-15 | 1.2 kB | |
| SecureBit.chat v4.8.9 -- Security Hardening Patch source code.tar.gz | 2026-06-15 | 22.7 MB | |
| SecureBit.chat v4.8.9 -- Security Hardening Patch source code.zip | 2026-06-15 | 22.7 MB | |
| Totals: 3 Items | 45.4 MB | 0 | |
This release closes a vulnerable dependency, removes committed TURN credentials, and tightens production logging.
Security
- DOMPurify upgrade — bumped from 3.4.4 to a patched release, resolving a high-severity XSS advisory (GHSA-87xg-pxx2-7hvx) in the incoming-message sanitizer.
- esbuild upgrade — cleared a high-severity advisory in the build toolchain.
npm auditnow reports 0 vulnerabilities. - TURN credentials removed from Git —
config/ice-servers.jsis no longer tracked; useconfig/ice-servers.example.jsas a template. Operators must rotate any previously committed credentials. - Production logger hardening — removed temporary debug branches so the logger no longer prints error context or info/debug payloads, only an opaque error code.
Documentation & Versioning
- Updated the supported-release table in
SECURITY.mdto the v4.8.x line. - Synchronized the version string across the header, manifest, README, and in-app initialization message.
Full changelog: https://github.com/SecureBitChat/securebit-chat/blob/main/CHANGELOG.md
