SARAH 1.0.6 is out today, and it's a big one: a major security update across the whole app.
1.0.5 made SARAH 100% free forever. 1.0.6 makes it hardened. If you run 1.0.5, update — in-app or from https://sarahai.co.uk
Here's what changed, in plain English.
Plugins can't run code on import anymore
This was the scariest one. Previously, importing a .sarah plugin could execute it. Now uploads are validated by parsing/compiling only, manifests are JSON-encoded, generated tools can't inject code through filenames, imports are contained to plugin roots, and plugin tool calls time out instead of hanging the agent.
Tokens out of URLs
The master API token is no longer placed in any window URL. Electron delivers it through sender-validated IPC, proves the backend knows the same token with an HMAC handshake before loading, and the browser UI uses scoped media tokens for images, audio and downloads. /api/health accepts the token header only, settings updates use an explicit allowlist, and query-string master tokens are rejected everywhere.
Teams is locked down
Teams was new in 1.0.5, and 1.0.6 secures it properly:
- The host is the only source of truth for guest permissions
- Every room message is signed with Ed25519 and verified on receipt — forged agent messages are dropped
- Members without chat permission don't receive the room key or encrypted history
- Invite relay URLs must use TLS, private/metadata addresses are refused
- The relay caps connections, frames, history and outbox growth, with per-IP limits
- Secret values are redacted from guest-triggered prompts, and the hidden-file list now covers
.git-credentials,.netrc, SSH keys, password databases and token stores
Your data is safer
- Providers, projects, settings, chats, memory, schedules, runs, MCP config, sandboxes and Time Machine manifests now write atomically
- Damaged data files are preserved as
.corrupt-*backups and reported instead of silently loading empty defaults — there's a Data Health section in Settings to list and restore them - Settings, providers, chats, tokens, pairing codes and logs are written with owner-only permissions
- Deleting a chat only removes the original after a backup succeeds
- Snapshot manifests can't write outside the project root, and Time Machine ignore rules no longer silently drop source folders
Updates, releases and installers hardened
- Update extraction has size caps, temp files are private, rollback deletes files the failed update created
- CSP is pinned to hashes of the actual boot script, remote images no longer allowed
- Release ZIPs are deterministic, the feed records the source commit, uploads refuse plaintext FTP, and live artifacts are checked against the signed feed
- Uninstallers require a SARAH marker and refuse to erase the home folder or filesystem root
- The Linux installer verifies the Chromium sandbox helper before making it setuid root
Plus a lot of reliability
Chat stream failures are reported again, the editor no longer loses unsaved buffers, file opens are sequenced, MCP tools survive beyond the first agent turn, provider calls have deadlines, branch names starting with - are rejected, discarding untracked files moves them to trash instead of deleting, screenshots are full-resolution lossless, background tabs pause polling, and core overlays now expose proper dialog roles and accessible names.
Getting it
SARAH 1.0.6 for Linux and Windows, still 100% free forever:
Updates verify the SHA-256 hash and the ed25519 feed signature before installing anything.
Top comments (0)