Security

Built in the open.
Verify everything.

Kudu is small, local and open source. Every release is built by public CI from the public code, and every file comes with a checksum you can check.

Open source

The whole app, MIT licensed. Nothing hidden, nothing compiled in from elsewhere.

Built by public CI

Releases are built by GitHub Actions from a tagged commit. You can read every step.

No servers to breach

No accounts, no cloud database. There’s nothing of yours anywhere but your computer.

Least privilege

Only the permissions dictation needs, and no admin rights to run.

Verify a download

Check the checksum

Each release includes SHA256SUMS.txt. Download it next to your file and compare.

macOSshasum -a 256 -c SHA256SUMS.txt --ignore-missing
Linuxsha256sum -c SHA256SUMS.txt --ignore-missing
PowerShellGet-FileHash .\Kudu-Windows-x64-Setup.exe -Algorithm SHA256

On Windows, compare the hash with the line for that file in SHA256SUMS.txt. All files are on the releases page.

Unsigned builds

Why your computer asks twice

Kudu is free, and its builds aren’t signed with paid certificates yet. Your system will warn you the first time; here’s what to do.

macOS

macOS quarantines apps from the internet that aren’t notarized. Clear the flag once after installing:

Terminalxattr -cr /Applications/Kudu.app

Windows

SmartScreen may warn that the installer is from an unknown publisher. Click More info, then Run anyway.

Linux

Packages aren’t from a signed repository. Install the .deb or .rpm you downloaded directly; checksums are below.

The install scripts on the download page do this for you, and you can always build Kudu from source instead.

Permissions

What it asks for, and why

Microphone

To hear you while you hold the key. Closed the moment you let go.

All

Accessibility

To notice the shortcut and type text into the app you’re in.

macOS

Input devices

To notice the shortcut (/dev/input) and type through a virtual keyboard (/dev/uinput).

Linux

None extra

A keyboard hook for the shortcut and UI Automation to type. No admin rights.

Windows

Report a problem

Found something?

Thank you. Security reports are taken seriously and fixed first.

Report privately

Use GitHub’s private vulnerability reporting on the Security tab. Please don’t open a public issue for anything exploitable.

Everything else

Bugs and ideas are welcome as GitHub issues. Include your OS and Kudu version.