Security on Arivu

Safer Self-Hosting, Less Guesswork

Wed, 08 Jul 2026 00:00:00 +0000

Context, 2026-07-13: Upgrades are additive-safe, preserve executable permissions under restrictive defaults, and provide useful activation diagnostics when a replacement cannot start. Existing data and configuration remain in place.

Update, July 11, 2026: The installer no longer requires GitHub CLI. Piped bootstrap keeps interactive prompts TTY-safe, DNS mismatches produce actionable warnings, and newer Ubuntu releases are tolerated rather than rejected only for being newer. Upgrades now verify and transactionally activate the matching app and installer binaries, roll both back if activation fails, and prompt browsers to revalidate embedded frontend assets. Tagged releases report the exact release version; development builds may report development metadata. Public HTTPS can still require correct DNS, firewall, or shared-proxy configuration.

Quieter Admin, Stronger Guarantees

Thu, 02 Jul 2026 00:00:00 +0000

Before we ship a wave of new features, we wanted the operating layer underneath them to be solid. This update rebuilds the admin experience on the app’s own storage, makes provider configuration a runtime concern instead of a restart concern, and adds a clear audit trail for sensitive actions.

None of this changes what Arivu looks like day to day. It changes how confidently you can run it.

A Native Admin Dashboard

The admin dashboard now runs entirely on the app’s own SQLite storage. Admins listed in ADMIN_EMAILS get an /admin area with sections for overview, API usage, users, system status, recent activity, collections, and an audit log.

Arivu Is Simpler to Self-Host Now

Mon, 15 Jun 2026 00:00:00 +0000

Arivu is moving in a simpler direction.

Update, July 2026: Since this post, Arivu added a first-party Linux VPS installer with plan, backup, restore, upgrade, reconfigure, and shared-proxy modes. The Go and SQLite runtime shape below is still current, but the recommended production path is now covered in Safer Self-Hosting, Less Guesswork and the guided self-hosting guide.

The app is now rebuilt around one Go application that serves the web UI, API, background workers, CLI commands, and migration tooling. The shipped frontend is embedded into the binary. Persistence is SQLite. Provider integrations use direct HTTP calls. The result is a self-hosted Arivu that has fewer pieces to run, fewer dependency trees to audit, and a clearer operational model.

Arivu From the Terminal

Sun, 10 May 2026 00:00:00 +0000

Arivu started as a web app and browser extension because that is where most bookmarking happens. But a second brain should not disappear the moment you leave the browser. Research, writing, operations work, and development all move through the terminal too.

The new Arivu CLI brings the same intelligence layer to command-line workflows. You can save links, search by meaning, inspect bookmarks, import exports, check reading stats, manage local profiles, explore graph connections, and boot a local Arivu stack without switching context.

Automated Security, Testing, and Code Quality

Sun, 08 Mar 2026 00:00:00 +0000

Historical note, July 2026: This post reflects the automation used by the earlier Python and JavaScript stack. The current Go-based app uses a different, smaller dependency surface and validation workflow. The product-level commitment still stands: automated checks should catch security, quality, and regression issues before release.

With the codebase now open source, we invested in the automation that keeps it healthy. This update adds continuous integration pipelines, automated dependency monitoring, static analysis, and a frontend test suite - the kind of infrastructure that catches problems before they reach you.

Production Hardening: Security, Speed, and Structure

Thu, 05 Feb 2026 00:00:00 +0000

Arivu is now more secure, faster, and easier to evolve. This update focuses on the invisible infrastructure work that separates a side project from a production-ready product.

We completed a comprehensive hardening pass across three domains: authentication security, database performance, and code architecture. Here’s what changed and why it matters.

Security

Your account is now protected against brute-force password attacks. Repeated failed login attempts trigger a temporary lockout, stopping automated guessing while letting legitimate users recover naturally.

Fortified & Fresh

Mon, 29 Dec 2025 00:00:00 +0000

Bookmarks don’t die, they just get buried. You save something brilliant, fully intending to return to it, and then… three months pass. Six months. A year. That article about distributed systems? Still sitting there, unread, slowly becoming irrelevant.

The problem isn’t that you don’t care. It’s that nothing reminds you.

Most bookmark managers treat every link the same: a flat list ordered by date, maybe grouped into folders you created with good intentions. There’s no concept of urgency, no sense that some bookmarks are aging out of relevance while others remain evergreen. Your collection becomes a timeline of abandoned intentions.