Someone proved they own the app
Keybrum attacks an app only after someone proved control of it: a tag on its page, a DNS record, or a file at /.well-known/keybrum-verify.txt. If that wasn't you or your team, check those places first: whoever added the tag or record can see the results.
The requests are safe by design
- Reads keep counts, column names and one redacted example; the data itself is not stored.
- Write tests are built to fail before anything is written.
- At most 12 requests per second on your host, slower when your app answers “too many requests”.
- No load tests, no brute force, no delete tests.
- On a server proven to serve the verified domain, one connection to each database, Docker and admin port to read its greeting. No password is sent.
The details are on the security page.
Didn't ask for this?
Write to [email protected] with the address of the app and the time of the requests. We stop the attacks while we check who verified the app, and close accounts that broke our acceptable use policy. Keybrum also checks a tag, DNS record or file again every 30 days: once it is gone, scheduled attacks stop.
Want the report for your own app?
Check your own app for free, then attack it and see what a stranger can do, with the fix for your coding agent.