What’s new in Secretus 1.0.8:

• Fixed an issue where an unsent file attachment could remain visible after signing out and signing in again.
• Logout now clears attachments, draft text, labels, authentication state, and generated links from every open Secretus extension window or compose tab.
• Improved account isolation when switching between users.

No permissions or data-collection behavior changed.

What’s new in Secretus 1.0.7:

• Fixed email sign-in when an address contains uppercase letters.
• Changed the Firefox keyboard shortcut to Alt+Shift+S (Option+Shift+S on macOS) to avoid a conflict with Firefox Screenshots.
• Improved sign-in reliability when switching between accounts.

No permissions or data-collection behavior changed.

Fixes email/password sign-in for accounts whose email address is entered with uppercase characters. Email aliases are now normalized consistently with the Secretus web application before Cognito SRP authentication.

No permissions, host permissions, data-collection categories, or secret-sharing behavior changed.

This release refreshes the complete Firefox interface with clearer hierarchy, improved
spacing, responsive states, and consistent light/dark styling. It now uses the official
Secretus website logo in the popup and browser surfaces, including the context-menu icon.
It also fixes an account-menu layering issue that could allow form text to appear above
the open menu. Secret-sharing behavior, encryption, permissions, and host access are
unchanged.

Security update:

One-time secret retrieval is now protected by a cryptographic proof derived from the random encryption key in the URL fragment. This prevents someone who knows only the secret ID or request path from consuming the secret.

The decryption key remains on the user’s device and is never sent to Secretus secret endpoints. No new permissions were added.

Accessibility and clarity fixes for the sign-in screen.

• The "Continue with Google" and "Sign in" buttons now explain why they are
  unavailable: pressing one without accepting the Terms and Privacy Policy
  highlights the checkbox and moves focus to it, instead of doing nothing.
• Those buttons are now announced by screen readers while unavailable, rather
  than being skipped entirely.
• Fixed a popup sizing issue affecting Chromium-based builds, where the window
  could remain widened after a failed sign-in.

No changes to encryption, permissions, or how secrets are handled.

Fixed a privacy issue: signing out now clears the secret list cached in this
browser. Previously the list — secret IDs and your own labels — stayed on the
device after sign-out and was visible to the next person signing in on the
same browser profile. No secret content or decryption keys were ever stored;
those exist only in the share link. Signing out also clears any unsent draft.