Security fixes are applied to the latest version. Install the newest release from GitHub Releases, or use Obtainium so updates arrive on their own.

If you discover a security vulnerability, please report it by emailing security@spoo.me. Do not open a public issue. We will respond as quickly as possible.

Please include:

• A description of the vulnerability and its impact.
• Steps to reproduce it, including the app version and Android version.
• Any potential fixes or mitigations you have identified.

Findings that affect the API, redirects or the database belong in spoo-me/spoo, but the same address works for both. When in doubt, send it here.

• The app signs in through the browser with PKCE and holds scoped tokens only. There are no API keys or account passwords stored on the device.
• Revealed passwords in the link editor mark the window secure, so they stay out of screenshots, screen recordings and the Recents thumbnail. Stats screens deliberately stay capturable.
• Every release ships a .sha256 checksum next to the APK, and all APKs are signed with the same certificate. An update that Android refuses to install over the existing app did not come from us.

We announce security updates through the GitHub repository and the Discord server. Watch the repo to stay informed.

Questions or anything else: security@spoo.me.