This release pins supported Electron 43.7.7. Every window runs with Chromium sandboxing enabled; recording/edit windows retain context isolation and no Node integration. Launchers reject sandbox-disabling arguments. On systems that restrict unprivileged user namespaces (Ubuntu 24.04+), the sandbox needs an AppArmor rule that allows them for Rough Cut only: the Debian package installs it, and the AppImage and portable folder ask first and install the same rule through pkexec after the user's password. Declining leaves the system unchanged and Rough Cut does not start. On first start the Linux launcher can also offer to install missing ffmpeg, xdotool and xinput through the system package manager, again only after the user agrees.
Automatic updates are off in this beta; releases are downloaded manually from GitHub Releases at endlessblink/rough-cut and checked with SHA256SUMS. The source contains inactive updater code: if it is ever activated, the Linux x64 AppImage controller verifies custom Ed25519 metadata against a pinned publisher SPKI public key before downloading. The signature binds version, platform, architecture, asset basenames and SHA512 checksums. electron-updater 6.8.9 then verifies downloaded bytes; a SHA256-verified previous AppImage is retained for explicit rollback. This custom signature is separate from OS code signing and unreleased electron-builder v27 signed-manifest features. The private signing key remains outside source and application packages, encrypted under owner custody. Checks/install never transmit projects or recordings; install/restore require idle recording/export and explicit user action. Production signing and a public install/restart/rollback test are not done, which is why it stays off. Debian uses the normal package manager; the application never bypasses repository authentication, and asks for administrator rights only for the two optional, user-approved steps above.
Rough Cut sends no analytics or crash uploads. Crash reporting is off by default; opt-in holds a minimal allowlisted event in memory. Every local export shows the exact payload and destination and requires confirmation. Memory dumps, error messages/stacks, user identifiers, file paths, recordings and project content are excluded. Browser-process termination loses the in-memory event. Updater staged-rollout identifiers are disabled and their request header is removed; this behavior is covered by the integration probe for the pinned dependency.
Optional AI graphics use the separately installed Claude CLI/login and send prompts through that service. Chromium may perform network activity of its own. Existing local runtime logs are separate from the report export and are never attached by this feature.
Report security issues privately through GitHub: https://github.com/endlessblink/rough-cut/security/advisories/new