BleachBit, the open-source system cleaner, has released version 6.0.4, addressing a critical flaw in its secure file wiping functionality on Windows. Previous versions of the software could fail to securely erase entire files, leaving fragments of sensitive data on disk due to the way Windows stores files in non-contiguous clusters. The update does not specify which prior versions were affected or the extent of data that might have survived a wipe. Users who have shredded sensitive files on Windows with earlier builds are advised to wipe free space on their drives to mitigate the risk.
The new version also introduces several other security enhancements and new features. BleachBit 6.0.4 now supports macOS, offering a Safari cleaner and enabling existing cleaners for browsers like Google Chrome and Firefox on the platform. While command-line support is fully functional on macOS, the graphical user interface is still under development. On macOS, BleachBit will warn users if Full Disk Access is not enabled, use native notifications, and delete empty folders when cleaning the trash.
A significant privacy improvement targets "supercookies" that persist beyond standard cookie purges. BleachBit now deletes dynamic HSTS (HTTP Strict Transport Security) data in six Chromium-based browsers and in Zen, a Firefox derivative. HSTS lists, which record sites that mandate HTTPS, can be exploited by websites to store tracking identifiers that survive normal cookie clearing.
Security hardening measures have been implemented across various aspects of the software. Shredding arbitrary files now prevents operations on the working directory or its parent, closing a vulnerability where empty strings or directory shortcuts could cause unintended deletions. On POSIX systems, BleachBit explicitly refuses to delete critical system directories like /, /proc, /sys, and /run. The software also no longer follows symlinks during wiping operations, and on Windows, it rejects wiping files through symlinks and truncating reparse points. Malformed file URIs from the clipboard are now skipped during shredding, and the application issues a warning if a drive being shredded is world-writable, as this compromises the security of the wipe.
To prevent potential command injection and DLL preloading attacks, the Windows build now calls `ipconfig` and `taskkill` using their absolute paths. Untrusted cleaner definitions are restricted from executing process or Windows Registry actions, and on POSIX systems, cleaner files located in world-writable files or directories are no longer loaded. XML parsing entry points universally reject DTDs, and the update check parses its XML as bytes to ensure DTD rejection even with declared encodings. Insecure `winapp2` and update-check URLs are now refused, and the wildcard count in `winapp2.ini` glob patterns is capped to defend against regex denial-of-service attacks. SQLite and URI construction in `Special.py` have been hardened against injection, downloaded chaff models are checksummed, and URLs opened in a browser are restricted to `http` and `https` schemes.
When running as root, BleachBit sanitizes the `PATH` environment variable, removes code-loading environment variables for subprocesses, and strips `LD_LIBRARY_PATH` from the environment passed to external commands. Debug logs are created with `0600` permissions and download directories with `0700`. The development process itself has also seen security upgrades, with Windows builds and tests migrated from AppVeyor to GitHub Actions, the addition of a CodeQL workflow for bug detection, a static analysis workflow for the CI/CD pipeline, and a fix for a potential code injection during CI translation updates.
New cleaners have been added for Android Studio, the Gradle cache, the fish shell, Zsh, and Python command history. These history files can contain sensitive information, including credentials, making their secure deletion important on shared machines. The Claude cleaner now also removes top-level log files.
