Security

Blurt hears what you say, so your words and your provider keys are what we protect first.

Found a security problem? Email support@teamnebula.ai privately. Please don’t post it publicly. Say what the problem lets someone do, how to reach it, and which Blurt version you saw it on (Settings shows the version).

We acknowledge reports within three working days and assess them within ten. Fixes ship in the next release; anything that exposes dictation content or credentials ships sooner. There is no bug bounty. We credit reporters in the release notes unless you would rather stay anonymous.

What Blurt protects

Your audio and transcripts. With the built-in on-device engine they stay on your Mac. With a cloud provider, audio goes to the provider you chose. Privacy lists every path in detail.
Provider API keys. Encrypted at rest with storage backed by the macOS Keychain. They are never written to logs or files and never shown back to the app’s windows after you save them.
Your local library. History, notes and agent messages live in a database in your user folder that only your account can read.

Agent connections

Coding agents talk to Blurt through a private, authenticated connection that only your macOS account can reach. Each agent gets its own credential and can only see its own sessions. The agent helper never reads Blurt’s database. Text Blurt reads aloud is cleaned first, so a reply cannot slip commands into the speech engine.

Paste and keyboard access

Blurt pastes your words by pressing ⌘V in the app you are using, and a small helper listens for your dictation key. That is why it asks for Accessibility and Input Monitoring. The helper never receives what you said.

How Blurt is built

Speech and writing engines are built from pinned upstream versions. Models are checked against a known checksum when they download.
Dependencies are audited on every change; a high or critical advisory fails the build.
The history of the code is scanned for leaked credentials on every change.
This beta is not yet signed or notarized by Apple, so macOS asks you to confirm the first launch (see Download). Signed, notarized builds are coming; they will update in place.

What is out of scope

Someone who can already run programs as you, or who has your unlocked Mac in hand. Blurt’s data is protected by your macOS account, not against it. Reports about a local, unprivileged program reaching your dictation, keys, agent connection or paste path are very welcome.