Security

Report a security issue

Last updated October 23, 2026

Keeping your crew’s conversations safe matters to us. If you think you’ve found a vulnerability in KeyUp, please tell us. We’d much rather hear about it from you first.

What we’ll do

• Aim to acknowledge your report within a few business days. KeyUp is run by one developer, so please be patient with us.
• Keep you updated as we investigate and fix it.
• Let you know when it’s fixed, and credit you publicly if you’d like.
• Not pursue legal action against good-faith research that follows this policy.

In scope

• The KeyUp Android app and Wear OS app (current beta builds from Google Play).
• The KeyUp web app (used on iPhone and in browsers), the web guest page, guest pass links, the watch pairing page and the web dispatch console.
• KeyUp APIs and real-time voice relay used by the apps.
• This website, keyupradio.com, including the beta sign-up form.

Especially interesting: accessing another person’s Space, room, audio, messages, recordings or transcripts; bypassing guest pass expiry or room permissions; account takeover; leaking AI API keys; listening to or decrypting a private call; and anything that lets you listen in without being shown in the room.

Out of scope

• Denial-of-service or load testing, spam, and social engineering of KeyUp staff or users.
• Physical attacks, or attacks that need a rooted/jailbroken or already-compromised device.
• Issues in third-party services (for example Google Play, Firebase or an AI provider). Please report those to them.
• Missing best-practice headers or TLS settings with no demonstrated impact, clickjacking on pages with no sensitive actions, and self-XSS.
• Reports from automated scanners without a working proof of concept.

Please

• Only test against accounts and Spaces you own or have permission to test.
• Don’t access, change or keep other people’s data. If you hit some by accident, stop and tell us.
• Give us reasonable time to fix the issue before sharing it publicly.

How we protect KeyUp

• All traffic between the apps and our servers is encrypted in transit. The encrypted connection ends at Cloudflare, which passes traffic on to our server through a secure tunnel, so Cloudflare can technically see what is not end-to-end encrypted while it passes through. Rooms, messages and regular calls are not end-to-end encrypted.
• Private calls (beta) are end-to-end encrypted: each call gets new keys on the two devices, our servers pass the audio along without being able to hear it, and both screens show a safety code to compare. Our servers still see who called whom, when and for how long. Private calls are new and haven’t been independently reviewed yet, so don’t rely on them for sensitive conversations until they have.
• Profile pictures are checked and stored only on our own server, with location and other hidden photo details removed, and they’re only shown to signed-in people who share a Space, a room or a friendship with you.
• Replay, transcripts and AI are off unless a Space turns them on, and people choose whether their own voice is saved for Replay, transcribed or heard by the AI. Guests are never recorded. (A talk someone missed when their connection dropped is held in the server’s memory for up to 5 minutes to deliver it, never on disk.)
• KeyUp makes transcripts on its own servers unless a Space owner or admin connects the Space’s own transcription provider. Then the audio of the people who agreed goes to that provider, which the app names before it happens. Teens are never sent to one, and the provider key is removed if the Space changes hands or the person who saved it leaves.
• Passwords are stored as secure one-way hashes. Push tokens, AI API keys and transcription keys are stored encrypted, and those keys are only used for the requests your Space makes.
• Guest passes only open the rooms they were made for, always expire (after 1 hour to 1 week), and can be turned off at any time.

The full design, including what is and is not end-to-end encrypted and the limits we know about, is on How KeyUp protects your conversations. For how we handle personal data, see our Privacy Policy.