Security

Audit status

Speakeasy has not yet completed an independent security audit. Private conversations use MLS (Messaging Layer Security, RFC 9420) end-to-end encryption built on an established Rust MLS implementation compiled to WebAssembly, but the application as a whole — client, server, and the way they use MLS — has not been independently reviewed. Treat every current release as beta software and read the threat model before relying on it for anything sensitive.

Security contact

Report security issues privately to:

security@speakeasy.im

Please do not report security issues in public channels (X, Patreon comments, public bug reports) before we have had a chance to respond.

Responsible disclosure

If you believe you have found a security issue in Speakeasy, include in your report:

• A description of the issue
• The affected version (client and/or server)
• Steps to reproduce
• Potential impact as you understand it
• Whether the issue has been shared anywhere publicly

Please do not:

• Access other users' data
• Disrupt servers you do not own
• Publish exploit details before we have had reasonable time to respond and ship a fix
• Use the issue for spam, abuse, or unauthorized access

In return: we will acknowledge your report, keep you informed of progress, credit you in the release notes if you want credit, and never pursue legal action against good-faith security research conducted under this policy.

Verifying downloads

Every public client release ships with SHA-256 hashes published in the release manifest, and the hashes are shown on each download card on the download section. Self-host server bundles ship with a SHA256SUMS file. Verification steps are in Why Windows may warn you.

Scope notes

• Speakeasy servers are independently operated. A vulnerability in the Speakeasy software belongs here; a misconfigured individual server belongs with that server's operator.
• Security research against your own self-hosted instance is always in scope and encouraged.