Desktop 1.0.0 withdrawn

This note used to sit at the top of CloakAPI for desktop. It is kept here so the withdrawn bytes stay recognisable.

The 1.0.0 Windows build has been withdrawn

CloakAPI Desktop 1.0.0 for Windows was withdrawn on 2026-08-10 and all three packages are gone. The three download URLs now answer HTTP 410 Gone with an explanation.

Why: the version of the PII engine bundled in that build only recognises personal names written in plain A–Z letters. A name containing any other letter could be cut short or missed entirely, and the part it missed was sent upstream in clear text.

If you installed it, uninstall it. You can identify what you have by SHA-256:

• CloakAPI-1.0.0-x64-setup.exe

  5a17ef7648dddfb1dddd4c631e220bd237cc0aeac2d5c504b09cf6bffa7cdadf

• CloakAPI-1.0.0-x64.msi

  29f24dbc52c705f4f3ccb2273050f631a62369df7bdb02cbf242863c3dde70c4

• cloakapi-desktop-1.0.0-x86_64.exe

  c6728c27613eafc48c5e88fd194ceeeca49cf3f2210b94fad3d18923cf8a3bb7

• installed cloakapi-desktop.exe (from the NSIS installer)

  09829d75247a05441b09697b3b87661d8583d3993bcbbf1dfc86ef497f64eb4c

Those hashes are identifiers so the withdrawn bytes stay recognisable. They are not an offer to download. 1.0.0 remains withdrawn (410). The 1.0.0 rows in release-integrity.json still carry quarantined: true and available: false.

⚠️ An earlier section on the desktop page told you to verify the published SHA-256 before running while the tip was still the leaking 1.0.0 build. Verifying a checksum proves you got the file the publisher meant to send. It does not prove the publisher should have sent it.

Current install steps are on CloakAPI for desktop.