BleachBit 6.0.4 fixes secure wiping that skipped clusters on Windows

The open source cleaner BleachBit reached version 6.0.4 this week, erasing caches, browser traces, and files on Windows, Linux, and now macOS.

If you shredded a sensitive file on Windows with an earlier build, parts of it may still sit on the disk where the wipe missed. Fragmentation is the ordinary case, since Windows scatters a file across noncontiguous clusters whenever it cannot find one open run large enough to hold it.

The release does not say which versions carried the bugs or how much of a given file survived, so there is no way to work back from a version number to a list of files at risk. Re-shredding an original is impossible once it is gone, which leaves wiping free space on the affected drives.

Supercookies that outlive a cookie purge

Chromium- and Firefox-based browsers keep a dynamic HSTS list, a record of which sites have told the browser to load them over HTTPS only. Any site you visit can write to that list, which makes it a place to park a few bits of identity that survive a normal cookie clearing. Read those bits back across a spread of domains and you have a tracking identifier again. BleachBit now deletes dynamic HSTS data in six Chromium-based browsers and in Zen, a Firefox derivative.

Paths that used to collapse into your working directory

Shredding an arbitrary file now refuses to take the working directory or its parent, which closes a path that collapsed to the current directory when given an empty string, a period, or two periods. On POSIX systems, BleachBit refuses to delete /, /proc, /sys, and /run even when the keep list is empty. Wiping no longer follows symlinks in wipe_write or wipe_contents, Windows refuses to wipe a file through a symlink, and truncation rejects reparse points. Shredding files handed over from the clipboard now skips malformed file URIs instead of acting on them, and BleachBit warns when the drive you are shredding on is world-writable, because wiping there is not safe.

Commands that could have been answered by the wrong binary

The Windows build calls ipconfig and taskkill by absolute path now. A program that invokes a command by bare name hands the choice to the executable search path, and anything an attacker can drop earlier in that path answers first. The DLL search path is hardened against preloading for the same reason. Untrusted cleaner definitions can no longer run process or winreg actions, and on POSIX, cleaner files in world-writable files or directories are not loaded at all.

XML parsing entry points reject DTDs across the board, and the update check parses its XML as bytes so the rejection still applies to a document that declares an encoding. Insecure winapp2 and update-check URLs are refused. The wildcard count in winapp2.ini glob patterns is capped as a defense against regex denial of service. SQLite and URI construction in Special.py is hardened against injection, downloaded chaff models are checksummed, and URLs opened in a browser are limited to http and https. Running as root, BleachBit sanitizes PATH, drops code-loading environment variables for subprocesses, and strips LD_LIBRARY_PATH from the environment passed to external commands. The debug log is created with 0600 permissions and download directories with 0700.

Windows builds and tests moved from AppVeyor to GitHub Actions, a CodeQL workflow was added to find bugs, a static analysis workflow now covers the CI/CD pipeline, and a potential code injection during the CI translation update was fixed.

New cleaners, and Macs finally count

Cleaners arrive for Android Studio, the Gradle cache, the fish shell, Zsh, and Python command history. Shell and interpreter history files hold whatever was pasted into a prompt, credentials included, which is why they are worth clearing on a machine that other people can read. The Claude cleaner now removes top-level log files.

macOS support is early but real: a Safari cleaner, existing cleaners such as Google Chrome and Firefox working on the platform, full command line support, and a GUI that is still coming together. BleachBit warns when Full Disk Access is off, posts native notifications, honors Cmd+Q, and deletes empty folders when cleaning the trash.