Note67 – Updates for November 2026 – Tighter File Access, Verified Models
2 min read
Hi Privacy Focused People,
New updates have arrived for Note67
Download at https://note67.com/download
What’s New
v0.1.29 · November 2026
There’s almost nothing new to learn in this one. It’s a security release: a few ways things could have gone wrong are closed off, and every library Note67 is built on is brought up to date. If you only update when there’s a reason to, this is a good reason.
Note67’s window can’t reach the rest of your disk
Your notes, transcripts and summaries are shown as HTML in Note67’s window. If anything in there ever managed to run code (and 0.1.28 did a lot to make sure it can’t), it could then ask the app to read, write or delete files outside Note67’s own folders. That could mean deleting a folder in your home directory, or saving a file somewhere it would run the next time you log in.
Every one of those requests is now checked against where it’s allowed to go. A note’s recordings and images stay inside Note67’s folders, deleting a note deletes that note’s recording and nothing else, and importing audio reads only the file you picked.
A downloaded model has to match before it counts
Transcription models are hundreds of megabytes fetched over the network, and a download doesn’t always arrive whole. Until now, whatever arrived was saved as the model and counted as downloaded. A failed download left you with a model that transcribed badly or not at all, and nothing to explain why.
Each model is now checked against its published checksum after it downloads, and a file that doesn’t match isn’t kept.
Paste takes images, and only images
Pasting into a note now accepts PNG, JPEG, GIF, WebP, BMP and AVIF, and refuses everything else. That includes SVG, because an SVG is a document that can carry code, not just a picture. The editor’s paste handling and the HTML sanitizer it uses are also updated for a cross-site scripting advisory.
Recording works on more microphones
Some microphones only deliver audio as 24- or 32-bit samples. Note67 refused those formats and stopped with an unsupported-format error, so on those machines recording didn’t work at all. Every format a microphone offers is now accepted.
One split character no longer sinks a transcript
Whisper hands back a transcript in short segments, and now and then it cuts a segment between the bytes of a single character. Chinese, Japanese and Korean text and emoji use several bytes per character, so one unlucky cut could fail the whole transcript. The rest of the transcript is now kept.
Fixes under the hood
- Imported MP3 and Ogg files convert to their exact length, without the padding the encoder added at the end.
- A PDF export that fails to save now says so, instead of waiting forever.
- The secure-connection libraries are updated for advisories that could weaken a connection, and the updater’s archive library for unsafe extraction.
- Tauri 2.12, SQLite 3.54, a newer whisper.cpp, and updated audio recording, decoding and Windows system-audio libraries.
- Note67 no longer bundles OpenSSL. Every secure connection now goes through one library instead of two.
As always: everything above happens on your device. No audio leaves your machine, and there’s no account to create.