Release notes
What shipped, and what has not.
Every production deploy round with its date and time, then what is built but not released, then the earlier history. The Android version currently on offer is read live on the download page.
[UPDATE]Your connected product
Start with your phone. See more in the portal.
Phone checks, family sharing and organisation security have different permissions and limits.
Personal
Your connected phones, family sharing choices, alerts, reports and product keys.
Organisation
Your organisation’s devices, server health, monitoring, members, roles and audit records.
Enterprise XDR
Incidents, event timelines, threat hunting and supported server response. Results depend on the telemetry agents actually report.
Product update · 2026-10-15
The download page reads the published APK version from the service. New Android work listed as Not released is in the source and private build checks; it is not a promise about the public download. Real-phone checks are still required. See the Android feature list and limits.
- Not releasedHub, web portal, Android source
Referral wallet and payouts, order e-mails, domain sweep, partial-screen work
- Referral wallet and payout requests: a derived balance (hold, available, requested, paid, and an Adjustment if a commission is reversed after payment), a payout request with the destination stored encrypted, and staff approval, rejection and a CSV for the accountant. Payment itself stays manual. See the referral page.
- Order and invoice e-mails: a receipt once per payment (items, discount, total, invoice number, last four characters of each key, invoice PDF), a credit-note e-mail, a commission e-mail and one confirmation reminder 24 hours after sign-up. Needs a real payment and working mail to verify.
- Domain sweep: links the hub writes into e-mails and pages use one configured public address (safeavio.com by default). The Android app in 4.48 already tries safeavio.com first and falls back to safeavio.com; both domains keep working.
- Android source version 4.50 (build 81) with the work on partial screens (network, web, scam, identity, device, privacy, Money Shield, family and settings) and portal modules; screens that depend on a real phone, a data provider or an Android limit stay marked Partial. This site does not call 4.50 the download: the download page reads the published version live.
main (merged, not recorded as deployed)
- LimitedDesktop, hub
Desktop pre-release for Windows and macOS; e-mail from safeavio.com
- Sentinel for Windows (.exe) and macOS (Apple silicon and Intel .dmg) 0.1.0-alpha.1, built on 13 October 2026, served from the download page with a SHA-256 for each file, a README and SHA256SUMS. Both are unsigned: Windows shows SmartScreen and macOS Gatekeeper blocks the first open. Pre-release software, for people who are comfortable testing it.
- Mail is live for the safeavio.com domain: a sign-up confirmation link and password reset by e-mail. Outbound mail uses port 2525 because the hosting provider blocks the usual ports.
- Trial keys: staff can issue a free key that ends by itself, audited, for a given number of days.
Desktop 0.1.0-alpha.1, mail
- AvailableAndroid app
Android 4.42 to 4.50: Money Shield, Wi-Fi safety, takeover alerts, better scans, new name Safeavio Sentinel
- Home has a new section, "What Sentinel does for you": 14 cards (Anti-Theft, Family safety, Scam, Link and QR checks, Virus and APK scan, Phone takeover, Hacked account help, Identity, Fake call or video, Wi-Fi and VPN, Privacy, Device health, Security report), each with its value and whether it is free, included or needs a key.
- Installers packed inside a .zip or .rar are found and matched with the virus list; an APK that lands in Download, WhatsApp or Telegram raises a warning even when no signature matches; the full scan can delete or quarantine them.
- Fewer false alarms: apps are compared with the installed app by signing certificate, store and phone-maker installers are recognised, and "Silent installers and miners" no longer lists WhatsApp, Telegram or Samsung apps.
- Protect hub is honest: a section where most screens are not built says "Partial". The look is the same green as the web portal.
- Found by testing every Home card on a real phone: the alarm test now confirms that it is sounding, screens that need a Safeavio sign-in or the breach-data key say they are partial, the Network page shows the real DNS protection state, and link history says when a hit came from a blocked list. A second pass fixed the full scan wording when APK files sit in the download folders and made the Home chips say Partial where a section is partial. Not yet tested on the phone: a real malware sample, the live QR camera, live family tracking.
- Money Shield (4.47): one place for money-fraud protection. UPI Shield checks the payee, name, amount and note for warning signs, Fake Banking App Shield compares installed apps with a list of Indian bank and payment apps, Recovery Center has offline guides for "I sent money to a scammer" and five other emergencies, and a guidance-only NFC and card section. Each part says Live, Partial or Guidance only; it gives risk warnings, never bank-confirmed answers.
- Recovery, updates and more (4.50): a Recovery hub at the top of Home and More with seven offline guides that start from what the phone shows now; in-app update check that verifies the file hash and the publisher certificate before the system installer asks; Bluetooth and nearby safety (new pairings, rogue keyboards, long-lived nearby trackers as a risk warning); a family dashboard that shows a member only what they chose to share, a guardian view for children, and a shared code word; warnings for many sign-in approval prompts (opt-in), unknown USB keyboards, and unusual background uploads (opt-in); and a download that is about a third of the old size (34 MB instead of 89 MB). Each part says Live, Partial or Guidance only.
- Completed screens (4.49): many screens that were marked Partial now do more or say precisely what is missing and why, the Web Protection screens explain that a page the browser already saved can still open after a site is blocked, and the status wording is consistent across the app. Screens that still depend on a provider, a key or a real-phone check stay marked Partial.
- Wi-Fi safety (4.48): a network security score with a reason for every deduction, open and weak-security warnings, a check for a look-alike network name with different security, router and DNS change, and a notice when a hotspot wants a login page. The Wi-Fi name needs the location permission, and the screen asks for it in plain words. Android does not let an app see man-in-the-middle attacks, so that is shown as not available.
- Keyboard and fake-app checks (4.48): third-party keyboards installed from outside a store or also holding Accessibility are flagged, and apps that copy the name of a popular app under a different package are listed with the official package they were compared with. Opt-in help for text messages (pick a message to check) and for unknown callers is off by default and stays on the phone.
- Phone takeover (4.47): Accessibility and notification-access changes are noticed at once, a payment app opened while another app can control the phone gives a critical warning, an optional call-context mode (off by default) warns when a new app gains powerful access during or just after a call, and one-tap buttons open the right Settings page. Signer reputation is still not configured, and the screen says so.
- Hub: all secrets now sit in one protected file managed by one tool; the virus list reads its sources every hour. The app is renamed Safeavio Sentinel (4.50). Published as the download on 13 October 2026.
Android 4.50
- AvailableHub, website
Virus list for phones, feeds and coverage page
- The hub builds a signed list of known Android malware (about 14,000 file fingerprints from an open virus database) that phones download and match offline; it rebuilds when the ClamAV database updates.
- The hub keeps its own malware hash list, fed by files the virus scanner on the hub names as malware, and by abuse.ch MalwareBazaar (key set on 2026-10-12); a timer reads the sources every hour. Every source is listed with its licence.
- Public coverage numbers at /android-protection, read live from the hub: kinds of malware, counts, sources, limits.
- Cloud virus check fixed for files between 10 and 100 MB (a global request-size limit refused them).
- Website content brought up to date: Safeavio Sentinel Mobile, Family and Release notes.
main
- AvailableHub, web portal, operations
Family safety, cloud virus check, off-site backups
- Family: map, member status, safe places, SOS, family chat and live tracking on the web portal; location is shared only with the member's consent.
- Cloud virus check: the virus scanner on the hub judges a file streamed by a phone, keeps only the fingerprint and the verdict, and never writes the file to disk.
- Nightly encrypted backups are copied to a second server and a restore drill proves the copy opens.
- Product keys, key QR for the phone, remote app configuration and a licence gate for paid sections.
- Incident 17:13–17:50 UTC: a full disk stopped the database and the API answered errors for about 35 minutes; no data was lost, and builds and deploys now refuse to start on a nearly full disk.
main
- AvailableAndroid app
Android 4.41: scans, virus list, automatic protection and family on the phone
- Quick scan, app scan and full phone scan compare apps and installers with the known-virus list on the phone and check for fake brand apps and hidden apps; one plain result with what to do.
- Automatic protection: a new app, a new download and the installed apps every 6 hours are checked in the background, with a notification if something is wrong.
- Scans send nothing. The virus list updates by itself: the phone downloads only what is new, stores each fingerprint once, and checks before every scan.
- Family on the phone: live sharing, SOS, safe places, chat and notifications without a push service.
- Profile page with licence status, a key QR scanner, a themed popup for every confirmation, a clear message when there is no internet, and a response to every tap.
- Published as the download on 12 October 2026. A phone on 4.1 must uninstall the old app once; updates then install over the top.
Android 4.41
- 06:31–06:34 UTCAvailableWeb console, hub
Round 6 — the new web console and role-based access
- New web console with personal, organisation, security-operations and internal workspaces; old dashboard links redirect.
- Role-based access: named permissions, six role bundles, and an endpoint that tells the console what you may do.
- Optional two-person approval for destructive server commands.
- Detection rule registry with ATT&CK and compliance metadata, a rules API and a dry-run test.
- Audit API, self-service account (profile, password, sessions, export, deletion request), device rename, reports built from real data.
- Dependency upgrades for the release gate: FastAPI 0.136.3, Starlette 1.7.0, cryptography 50.0.2, anyio, axios and lodash.
- New public website for Safeavio Sentinel, followed the same day by restyled sign-in and sign-up pages.
main e9d5ed2
- 21:48 UTC, hotfix 21:58AvailableHub, agents, Android relay
Round 5 — audited server commands and incident lifecycle
- Server commands go through an audited lifecycle: 35 typed actions, confirmation and preview for reboot, shutdown and firewall disable, real outcomes shown.
- Incidents gain a lifecycle with append-only history.
- Ingest hardening: rate limit, size and batch caps, de-duplication per organisation, a clock-skew window and a dead-letter store.
- Audit-trail retention job added, switched off. MD5 update usage is now counted.
- Hotfix: agent timestamps were rejected on Python 3.10 for ten minutes; all 168 affected events were replayed, none lost.
- 20:12 UTCAvailableOperations
Backups and restore drills
- Daily checksummed backups at 02:30 UTC, kept 14 days (at least 3).
- Weekly automated restore drill on Sundays; the first drill passed.
- A corrupt index in the anomaly store, found by the first backup, was repaired.
- 17:59 UTCAvailableHub
Round 4 — PostgreSQL-ready backend, sealed secrets
- One event store for reads and writes; no schema changes from the application role.
- Monitoring stores scoped per organisation; database-monitor and alert-channel secrets encrypted at rest.
- Production still runs on SQLite; the PostgreSQL switch has not been made.
- 17:29 UTCLimitedAgents
Signed agent updates
- Release root v1 generated; the hub now signs update manifests with Ed25519.
- The full Linux and macOS agents pin the root and verify signature, expiry, version, hash, size and platform.
- Recorded deviations: the root is held on the hub and signs directly; legacy MD5 updates accepted on the internal channel until 15 October 2026.
- 16:30–16:35 UTCAvailableWeb console, hub, Android relay
Round 3 — organisations in the console
- Organisation switcher in the header; desktop devices page; incident resolve with a note.
- Organisation routes fixed (they failed on every call before).
- Billing administration limited to the platform operator; a route that accepted a full password hash removed.
- Android command delivery with lease and acknowledgement, and a privacy-preserving heartbeat, on the server side.
- Anomaly records now kept for 30 days.
- 14:08–14:19 UTCAvailableHub, agents, web console
Rounds 1 and 2 — tenant isolation on every write
- Every write and ingest path stamps the organisation of the authenticated user, server or device. This fixed hub telemetry, which had been refused on every call.
- Real roles enforced; access tokens revoked on sign-out; websockets check revocation.
- Password vault encrypted in the browser; breach checks use k-anonymity; vault and dark-web watch list moved to per-user storage.
- Agents: no shell in security fixes, hub TLS verified by default, constant-time key checks, fail-closed installers.
- The console stopped showing fabricated metrics, status and contact results.
- Not releasedAndroid
Safeavio Sentinel Mobile for Android 4.2
- Built and signed with a new private release key on 1 October 2026; not published and not yet run on a phone.
- On-device scam, link, QR, phone-number and password-exposure checks; new Sentinel screens.
- One command consumer with honest acknowledgements; location and the installed-app list sent only when needed.
- Phones on 4.1 must uninstall and reinstall once, because 4.1 was signed with a different key.
- Not releasedDesktop
Sentinel for Windows and macOS
- Encrypted quarantine container with journalled restore, a versioned policy contract, evidence rules and 90-day detection retention.
- No signed installer has been built or shipped: platform code signing is an open release gate.
- Not releasedHub
PostgreSQL with row-level security
- A loaded PostgreSQL database with 24 row-security policies, tested in CI and on staging.
- The switch was attempted twice and reverted; the cause was found and fixed in code, and the switch is pending.
- Platform
XDR, specifications and isolation groundwork
- A live detection pipeline mapped to MITRE ATT&CK, an XDR command center, and Android device protection in the same timeline.
- Fifteen architecture specifications written; all seeded demo data removed from the XDR layer.
- Agent updates compared with SHA-256 instead of MD5; hard-coded fallback credentials removed.
- Row-level security verified against a real PostgreSQL server; an isolated staging service.
- Platform
Safeavio ServerGuard
- First deployment at safeavio.com with a backend, web dashboard and agents for Linux, macOS and Windows.
- Security scans with matching depth across the three operating systems, with saved history.
- A command queue delivered through heartbeats for machines behind NAT.
The older version history that used to be on this site could not be traced to a source and was removed. For the current Android version, see the download page.
Re-checked against our documentation on 2026-10-14.