Server compromise
An attacker steals our entire database. They get encrypted blobs, not plaintext. They cannot brute-force without your Secret Key.
A working zero-knowledge system has receipts. Below is every cryptographic primitive Keevo uses, every key it derives, and every place plaintext could leak — annotated, sourced, and reproducible.
An attacker steals our entire database. They get encrypted blobs, not plaintext. They cannot brute-force without your Secret Key.
Pinned TLS plus authenticated ciphertext. A network attacker intercepting your sync sees noise, not credentials.
AutoFill matches by exact origin, never by visual similarity. A phishing site at vletcombank.com cannot trick AutoFill.
Vault encrypted at rest with a key derived from Master Password + Secret Key. A stolen iPhone with no biometric is useless.
A device with active malware running as the user can read decrypted vault state. No password manager survives this — and we won't pretend otherwise.
Lose both Master Password AND Recovery Kit and the vault is unrecoverable. By design — that's what "we can't read your data" actually means.
Every primitive below is documented in a public RFC or peer-reviewed paper. We don't invent crypto — we wire well-known building blocks correctly.
When you sign up, Keevo generates a printable PDF holding your Secret Key, an emergency QR, and step-by-step instructions. Print it. Put it somewhere offline. We never see it.
14-day engagement covering the Rust core, sync protocol, and recovery flow. 2 medium findings, both fixed and verified. Full report PDF + signed hash.
Read report (PDF) →A signed statement at status.keevo.tuanle.dev/canary that says we've received zero NSL/gag-order requests. If it stops updating, you'll know what to assume.
Current canary →Government requests received, complied with, refused. Q1 2026: 3 received, 0 produced plaintext (we don't have any to produce).
Q1 2026 report →Up to $25,000 for vault-decryption findings. Coordinated disclosure, 90-day window, public credit if you want it.