Harden vault workflows and professionalize GitHub presentation

.eas/workflows/build-android-production.yml

@@ -1,7 +1,7 @@
 name: Build Android production
 
 # Release-oriented triggers to conserve EAS build credits (free tier):
-# - push a version tag (e.g. v2.1) to build that release, or
+# - push a version tag (e.g. v3.3.1) to build that release, or
 # - run it manually from the Expo dashboard ("Run workflow") / `eas workflow:run`.
 # Intentionally NOT triggered on every push to main, to avoid burning build minutes.
 on:

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,4 @@
-blank_issues_enabled: true
+blank_issues_enabled: false
 contact_links:
   - name: Security vulnerability
     url: https://github.com/TheStreamCode/keysoft/security/policy

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+
+updates:
+  - package-ecosystem: bun
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '06:00'
+      timezone: Europe/Rome
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -32,12 +32,8 @@ jobs:
         with:
           bun-version: '1.3.14'
 
-      # Dependabot edits package.json but cannot regenerate bun.lock, so a frozen
-      # install fails on every one of its pull requests -- which is the sole reason
-      # they are all red. Typecheck, lint and test still run either way; only the
-      # lockfile constraint is relaxed, and only for that actor.
       - name: Install dependencies
-        run: bun install ${{ github.actor == 'dependabot[bot]' && '--no-frozen-lockfile' || '--frozen-lockfile' }}
+        run: bun install --frozen-lockfile
 
       - name: Check formatting
         run: bun run format:check

CHANGELOG.md

@@ -4,8 +4,32 @@ All notable project changes are documented here.
 
 ## [Unreleased]
 
+No unreleased changes.
+
+## [3.3.1] - 2026-08-09
+
+### Release
+
+- Prepared Keysoft 3.3.1 with native runtime 3.3.1 and Android production build target 130. EAS remote versioning remains authoritative and auto-increments from build 129;
+  Google Play submission remains a separate manual step.
+
 ### Security
 
+- Made PIN rotation and transparent KDF upgrades transactional: preference reads now
+  happen before vault mutation, ciphertext and verifier metadata define the core commit,
+  and a later biometric cleanup failure can no longer roll back only one side of the
+  vault. An unrecoverable pre-commit rollback still closes the authenticated session.
+- Changed validated backup imports from repeated per-record writes to one encrypted batch.
+  Imported records are merged by ID, password limits are checked against the merged vault,
+  all ciphertext is prepared before persistence, and decrypted caches update only after
+  the batch succeeds.
+- Reject backup files whose size cannot be established before reading them, and reject KS1
+  payloads that lack a complete AES-CBC ciphertext block or are not block-aligned.
+- Require an active vault key before clearing password or note collections, and explicitly
+  remove `SYSTEM_ALERT_WINDOW` from generated Android manifests.
+- Prevent initial PIN setup from overwriting an existing verifier. If first-time database
+  initialization fails after a new verifier was saved, remove that verifier and clear all
+  authentication/key state before returning failure.
 - Kept the cached master-key verifier unchanged when its SecureStore write fails, so an
   unpersisted verifier cannot be observed later in the same session.
 - Closed the authenticated session and cleared the in-memory vault key if a transparent
@@ -42,12 +66,28 @@ All notable project changes are documented here.
 
 ### Tooling
 
+- Updated Expo SDK 57 packages to the compatible versions selected by `expo install`,
+  refreshed compatible JavaScript dependencies, removed the duplicate TypeScript ESLint
+  plugin registration, and restored `expo-doctor` to 20/20 checks.
+- Added weekly Bun Dependabot updates and made every CI installation use the committed
+  lockfile with `bun install --frozen-lockfile`.
 - Added `.codex/` to the ignored local agent-state directories, so a future Codex session
   cannot leave working state staged by accident, and folded the redundant trailing
   `.claude/settings.local.json` rule into the `.claude/` entry that already covered it.
 
 ### Documentation
 
+- Reworked the GitHub README around the product value proposition, an immediate Google
+  Play call to action, concise trust links, and a four-screen gallery sourced from the
+  production store listing. Removed fast-stale dependency/test counters from the product
+  overview and aligned contributor validation with the one-command verification workflow.
+- Disabled blank GitHub issues so bug, feature, and private security reports follow the
+  repository's structured intake paths.
+- Updated the public GitHub description around Keysoft's offline-first promise and changed
+  the repository homepage from the generic studio site to the product's Google Play page.
+- Added the dated full security and code-audit report in
+  `docs/security-audit-2026-08-08.md` and synchronized the security, development, and
+  release guides with the hardened import, PIN-change, dependency, and permission rules.
 - Documented the accepted cryptographic and operational trade-offs in `docs/security.md`
   under a new "Known Limitations" section: the shared AES/HMAC key, the PBKDF2-SHA1 backup
   KDF, the six-digit master PIN keyspace, the absence of unlock throttling, opt-in

CITATION.cff

@@ -5,5 +5,6 @@ authors:
   - family-names: Gasperini
     given-names: Michael
 url: 'https://github.com/TheStreamCode/keysoft'
-version: '3.3.0'
+version: '3.3.1'
+date-released: '2026-08-09'
 license: 'Apache-2.0'

CONTRIBUTING.md

@@ -9,10 +9,13 @@ biometrics, import/export, notifications, or release configuration.
 ## Development Setup
 
 ```bash
-bun install
+bun install --frozen-lockfile
 bun run start
 ```
 
+Use Bun 1.3.14 and Node.js 22.13 or newer. The lockfile is part of the reviewed
+dependency graph and must remain frozen during clean validation.
+
 Android development uses Expo Go for day-to-day work. Release-grade validation
 for Argon2 and native modules requires an EAS/native Android build.
 
@@ -21,10 +24,8 @@ for Argon2 and native modules requires an EAS/native Android build.
 Run:
 
 ```bash
-bun run typecheck
-bun run lint
-bun run test
-bunx expo-doctor
+bun run verify
+bun run deps:audit
 ```
 
 For Android release-related changes, also run: