From d7d93f6e0cb5db140a842228eb42a25d2b789bd3 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 26 Jun 2026 11:49:07 -0700 Subject: Auto log-out wipes the saved-to-device vault too (full device wipe) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With a logout timer set, signing out now removes everything from the device including the password-protected vault — nothing survives, so the recovery phrase is required to return. Updated the setting copy to say so. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/app.js | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) (limited to 'src/app.js') diff --git a/src/app.js b/src/app.js index 332a426..a1d5dfa 100644 --- a/src/app.js +++ b/src/app.js @@ -1025,8 +1025,8 @@ function applyBootAutoLogout() { if (!(ms > 0 && away >= ms)) return; try { sessionStorage.removeItem(ACCOUNTS_KEY); } catch {} try { localStorage.removeItem(WATCH_KEY); } catch {} + try { localStorage.removeItem(VAULT_KEY); } catch {} clearWalletCaches(); - wipeBlankVault(); } // Remove every trace of the open wallet from this device: the session, the @@ -1040,22 +1040,15 @@ function clearWalletCaches() { } catch {} } -// A blank-password vault offers no protection and would auto-unlock on the next -// open, undoing the sign-out — so wipe it too. A password-protected vault stays. -function wipeBlankVault() { - const blob = loadVaultBlob(); - if (!blob) return; - try { decryptVault(blob, ''); } catch { return; } // needs a real password — keep it - try { localStorage.removeItem(VAULT_KEY); } catch {} -} - -// Full sign-out after the app's been backgrounded past the limit. +// Full sign-out after the app's been backgrounded past the limit: remove every +// trace of every wallet from this device — including the saved-to-device vault +// (password-protected or not). You'll need your recovery phrase to get back in. function autoLogout() { if (ui.screen !== 'wallet') return; // don't interrupt unlock / claim flows try { localStorage.removeItem(WATCH_KEY); } catch {} + try { localStorage.removeItem(VAULT_KEY); } catch {} clearWalletCaches(); - wipeBlankVault(); - lock(); // wipes the session + vault password and shows the unlock / vault screen + lock(); } function lock() { -- cgit v1.2.3