Plainpad 1.2.0-alpha.1 — Quick Search and Security Hardening

Aug 28, 2026

The first alpha of Plainpad 1.2.0 is available for testing. It adds a quick search overlay, makes the interface remember how you left it, and closes a batch of security issues in authentication and the auto update service.

This is an alpha release. It is meant for testing and feedback, not for production instances. Back up your database before trying it.

What’s New

Quick search with Ctrl/Cmd + K

Press Ctrl + K (or Cmd + K on macOS) anywhere in the app and a spotlight overlay appears. Start typing and matching notes show up straight away — no clicking into the sidebar, no scrolling through the list.

If nothing matches what you typed, Plainpad offers to create a new note using your keyword as the starting point. Searching for something you haven’t written yet turns into writing it, in one keystroke.

Menus remember their state

The sidebar and the aside menu now keep their open or closed state between sessions. If you work with the sidebar collapsed, it stays collapsed the next time you open Plainpad.

Demo data seeder

A new DemoSeeder fills the database with realistic notes. It’s aimed at anyone evaluating Plainpad, developing against it, or running a demo instance, and it removes the need to type filler content by hand.

Security Fixes

Several fixes in this release harden authentication and the update path:

• Login rate limiting — POST /v1/sessions is now rate limited, which stops password guessing at scale against the login endpoint.
• Password reset hardening — expiry handling on reset tokens has been fixed, along with related weaknesses in the auth flow.
• Account lockout via password reset — the token-based reset flow could be used to lock a user out of their own account. That’s fixed.
• setup.php blocked after install — the installer is no longer reachable once installation is complete, which removes an XSS vector through unescaped POST values.
• TLS verification in auto updates — the auto update service now enforces TLS verification and only accepts trusted origins.

Other Changes

• The Docker stack now starts the CRA dev server automatically and skips installs when the dependency folders already exist, so spinning up a development environment is a single command again.
• The nginx client_max_body_size limit was raised, so larger uploads no longer get rejected by the proxy.

Trying It Out

Grab the alpha from GitHub:

• Plainpad 1.2.0-alpha.1 release notes

Install it on a test instance rather than upgrading a live one — see the Installation guide for the steps. If you run into anything broken, please open an issue with your PHP version and how to reproduce it. Suspected security issues should go through the channels on the Support page instead of a public issue.

Feedback on this alpha is what decides how quickly 1.2.0 reaches a stable release. Thanks to everyone testing it.