That is the title of the official r/kloakapp post from 21 February 2026. The week before, users said strangers appeared in servers they never invited anyone to, then the secret key that was the whole account started returning “invalid.”
r/discordsucks, 20 February 2026, thread “Kloak.app - message from person awdwadwa.” The original post asked whether other people had received DMs from a user named awdwadwa about deleting their account, security gaps, and access to private messages and user lists.
Replies in that thread, as indexed:
A separate r/kloakapp post, later deleted, described “a few security vulnerabilities which caused the Kloak team to shut the service down for a few days to fix.” The official reply under that post was gratitude and “There’s a lot more coming soon.”
r/kloakapp, 21 February 2026, “WE’RE REBUILDING THE FOUNDATION.”:
Over the past days, our community has grown faster than we anticipated, and with that growth came challenges we weren't fully prepared for. Rather than patch over the cracks, we're doing what our values demand: stopping, looking closely, and getting it right. We've begun a full investigation and restructure of our infrastructure…
Comments, as indexed: users locked out, confusion, staff saying logins were paused and accounts would work again. Other users described bots, raids from 19 February, mass friend requests, and people talking in channels without permission. Staff later: a “controlled test run,” doors opened “cautiously.”
A staff account on the same subreddit, asked about future wipes, had already been asked “would there be another wipe of the server when some security issues rise up again?” That is the question you get after the first wipe.
Official framing is growth. User framing is keys and strangers. Both can be true. Only one of them is what “privacy-first architecture” is supposed to prevent.
A gist, Androser420/ab2652aff5bd0add7facef5765af2c9a, titled “Possible scam surrounding Kloak.app,” was indexed by search engines and later 404’d. We did not archive the full text before it vanished. Indexed excerpts claimed:
kloak.lovable.app URL.Indexed replies in the same gist said Jim confirmed Lovable for the landing page only, not the chat app, and that the Join page’s AI-tool list was being used as “proof” of a vibe-coded backend.
What we independently verified: the live Join page still names Lovable. The live bundle still contains a fatal error if the published key has role service_role (that key would bypass row-level security). Official Reddit did pause the service and talk about a rebuild in the same week users reported invalid keys. We did not reproduce a database dump, and this site will not publish exploit steps. If you donated during that window and your history vanished, the official post is the admission you get.
20 September 2026, /assets/index-BqPYhYBf.js:
VITE_SUPABASE_PUBLISHABLE_KEY is set to a service_role key. Use anon/publishable key only and rotate leaked service_role key.
That is a guardrail, not a leak by itself. Guardrails get written after someone ships the wrong JWT. The anon key currently in the bundle is a 10-year JWT (iat 1771685061, exp 2087045061) for project ref foquucurnwpqcvgqukpz. Registration still posts username, key_hash, hcaptcha_response, and banner_color to a registration URL. Local Storage key kloak-auth holds the secret key and the hash.
Production CSP still allows ws://localhost:8787 and http://ipc.localhost. That is leftover debug surface on the page they tell you is the architecture of privacy.
YouTube comments on official videos: “registration temporarily disabled,” “Registration failed” repeated. r/kloak later: “new registration is locked at the moment,” plus a user whose saved key started returning invalid overnight. A privacy app whose only credential is a string cannot afford “invalid secret key” as a load-shedding message. That string is the person.
The February rebuild is the argument for opening the code. They did the opposite of that argument. YouTube, still: clean it up first, document it, then maybe. Privacy Guides, March 2026: not open source, not E2EE, marketing and listing sites claiming otherwise. The foundation they rebuilt is still a binary, still holding messages staff can read, which the FAQ calls “the minimum required to operate the service.”