Written for people who read these
Security notes
What Virumo does with your credentials, what it asks of your device, where it connects, and what it refuses to pretend about.
01 · Principles
The rules we build to
- Secure by design. Security is decided when a feature is designed, not patched on when it ships.
- No backdoors, ever. There is no hidden diagnostic mode, no remote switch, and no build we keep for ourselves.
- Least privilege. The app asks for the minimum the job needs, and no more, on the device and in the code.
- All input is hostile. Playlists, guide data and panel responses are treated as attacker-controlled, because they are.
- No secrets in source. No keys, tokens or credentials are committed, and none are shipped inside the app.
- Network discipline. The app talks only to the servers you configure, on the schedule the screen you're on requires.
- Security is a blocking gate. Every release passes a security review before it goes out; a failure stops the release, not the review.
02 · Credentials
Where your login lives
Xtream usernames and passwords are held in the device's encrypted keystore, which is hardware-backed on devices that offer it. They are never written to the app database and never placed anywhere a log or a backup could read them back.
The database stores credential-free templates instead: a stream address with placeholders that are resolved in memory, at the moment you press play. Delete a playlist and its credentials are deleted with it, in the same action.
03 · Permissions
One permission, and why
Virumo requests INTERNET and nothing else. It needs it to reach the playlist, guide and streams you configure. There is no storage permission, no location, no contacts, no microphone and no camera, so there is nothing extra to revoke and nothing extra to misuse.
04 · Network
Where the app connects
Virumo connects only to the servers you enter: your playlist host, your guide source and your provider's streams. There is no analytics endpoint, no crash reporter, no account service and no update ping of our own.
Two limits are worth stating rather than hiding. The Xtream protocol carries credentials inside stream URLs on the wire, which is a property of the protocol and not something a player can fix. And many panels only offer plain http, so the connection is unencrypted; Virumo tells you when it is connecting insecurely instead of pretending otherwise.
05 · Untrusted playlists
A playlist is attacker-controlled input
Stream addresses are checked against an allowlist of schemes: only http and https are played. A file:// or content:// entry is rejected, so a hostile playlist cannot point the player at your device's own storage.
Channel names, group names and guide text are rendered as text, never as markup or a path, so an entry cannot smuggle a script or a file reference into the interface. No playlist entry can reach stored credentials, whatever it claims to be.
06 · Reporting a problem
Tell us before you tell the internet
If you believe you've found a vulnerability, please report it through the contact form with enough detail for us to reproduce it. We ask for responsible disclosure: give us a reasonable window to fix the issue before publishing it.
We acknowledge every security report within three working days, and we'll tell you what we're doing about it and when it ships.
If you find something we've missed, we'd rather hear it from you than read about it.