Signal macOS app fails to permanently delete messages, exposing them for days
Security researcher Harry Sintonen found that Signal’s macOS desktop client only marks messages as deleted, keeping them in an SQLCipher log file for up to several days until a 1000‑page threshold is reached. The lingering data can be recovered from the local database or backups, weakening Signal’s promised disappearing‑message feature.