Changelog

Curated release notes — not auto-generated from every commit. During alpha, watch GitHub Releases on App for tags like v0.1.0-alpha.1.

Unreleased / alpha

SyncBins is pre-1.0. The hosted product and docs evolve together. Notable areas in the current codebase:

Web client: onboarding wizard (create / pair / restore), Inbox + bins, composer, drag/drop, clipboard hint, QR device pairing, quick-unlock PIN, Settings panes
Server: Fastify REST + WebSocket, SQLite, local/R2/Azure blobs, single- and multi-tenant modes, Stripe hooks (hosted)
Integrations: @syncbins/mcp MCP tools
Mobile app (beta): iOS/Android (.NET MAUI) — QR pairing, PIN + biometric unlock, encrypted sync

Recent security work:

QR device pairing with a 6-digit verification code and explicit approval on the existing device (defeats QR-photograph hijack).
Per-item authentication — items and blob attachments carry a master-key-derived MAC (sig); clients reject anything the server forged, relabelled, moved between bins, or whose attachment was swapped. Enforced (unsigned items rejected).
Mobile at-rest hardening — master key held in memory only; PIN-wrapped (Argon2id) + optional biometric unlock; lock-on-background; HTTPS-only transport.

See App/SECURITY.md and Mobile/SECURITY.md for the full model.

This list describes what exists today, not a promise of stability.

How releases work (maintainers)

Pushing a git tag v0.1.0-alpha.N triggers CI to build multi-arch Docker images (linux/amd64, linux/arm64) as ghcr.io/syncbins/syncbins, push to GHCR, and attach a deploy zip. Raspberry Pi and other ARM hosts pull the arm64 manifest automatically. See App README → Cut an alpha release and Raspberry Pi.

Self-hosters: Upgrades.

Roadmap What is explicitly not built yet.