v1.4.8
Tightened security: all connections are now forced over HTTPS.
Security pass after an audit of the published APK. Nothing was being leaked, but a few defaults were looser than they should have been.
Smaller, obfuscated code
Code shrinking is now enabled for release builds, which removes unused code and makes the app harder to reverse-engineer.
Unencrypted connections are now blocked
The app previously allowed plain HTTP to any server. It now refuses everything except HTTPS — with one deliberate exception for the app talking to itself on your own device, which never touches the network. If a music source ever tries to redirect to an unencrypted link, the connection is dropped instead of quietly followed.
Invalid certificates can no longer be accepted
Every connection now verifies the server’s certificate against the system trust store, with no way to bypass it. This is what stops someone on the same Wi-Fi from intercepting what you are listening to.
Release builds are no longer debuggable
Explicitly disabled, rather than relying on a default. A debuggable release lets anyone attach to the running app and inspect it.
Downloads refuse insecure links
If a download URL ever comes back unencrypted, the download now fails loudly instead of fetching your music in the clear.