SHA256

0 Fork 0

T

Yuvomi Mobile Contributors 2b9996ff3f fix(android): harden origin isolation and native file lifecycles

Block cross-origin POSTs, preserve bounded generated exports without relaxing CSP, bind picker results to their initiating context, erase camera cache and constrain platform permissions. Upgrade vulnerable build/test tooling and lock runtime/build dependencies. JVM regressions, lint and unsigned release builds pass; extended emulator validation remains separate.

2026-10-21 07:25:00 +02:00

android

fix(android): harden origin isolation and native file lifecycles

2026-10-21 07:25:00 +02:00

docs

chore(repo): establish isolated mobile repository and upstream audit

2026-10-20 23:17:09 +02:00

ios

test(ios): cover context erasure and native capability restrictions

2026-10-21 07:18:42 +02:00

scripts

fix(ios): restrict authentication capabilities and validate bootstrap types

2026-10-20 23:45:01 +02:00

.editorconfig

fix(android): harden origin isolation and native file lifecycles

2026-10-21 07:25:00 +02:00

.gitattributes

chore(repo): establish isolated mobile repository and upstream audit

2026-10-20 23:17:09 +02:00

.gitignore

fix(ios): restrict authentication capabilities and validate bootstrap types

2026-10-20 23:45:01 +02:00

.swift-format

fix(ios): restrict authentication capabilities and validate bootstrap types

2026-10-20 23:45:01 +02:00

LICENSE

chore(repo): establish isolated mobile repository and upstream audit

2026-10-20 23:17:09 +02:00

README.md

chore(repo): establish isolated mobile repository and upstream audit

2026-10-20 23:17:09 +02:00

THIRD_PARTY_NOTICES.md

chore(repo): establish isolated mobile repository and upstream audit

2026-10-20 23:17:09 +02:00

README.md

Yuvomi Mobile

Independent, community-maintained Android (Kotlin/WebView) and iOS (SwiftUI/WKWebView) companions for user-owned Yuvomi servers. Not affiliated with or endorsed by upstream.

Development build - not production-ready. See validation status. No mobile backend, advertisements, telemetry, tracking, subscriptions, or mandatory cloud. The configured server supplies the application and retains responsibility for its own integrations, version checks, security and privacy.

Use a root-hosted HTTPS instance with a valid certificate, including private servers accessible through your VPN. Custom ports are supported. HTTP and subpath deployments are intentionally rejected. Enter the server on first launch; use Server settings to reconnect or erase local browsing data and switch installations.

MIT licensed. Upstream notices are preserved in THIRD_PARTY_NOTICES.md. This implementation is AI-assisted (OpenAI via OpenCode) and requires human security review before release. No upstream modification or public submission is authorized.