Security notes

• Secure by design. Security is decided when a feature is designed, not patched on when it ships.
• No backdoors, ever. There is no hidden diagnostic mode, no remote switch, and no build we keep for ourselves.
• Least privilege. The app asks for the minimum the job needs, and no more, on the device and in the code.
• All input is hostile. Playlists, guide data and panel responses are treated as attacker-controlled, because they are.
• No secrets in source. No keys, tokens or credentials are committed, and none are shipped inside the app.
• Network discipline. The app talks only to the servers you configure, on the schedule the screen you're on requires.
• Security is a blocking gate. Every release passes a security review before it goes out; a failure stops the release, not the review.

Xtream usernames and passwords are held in the device's encrypted keystore, which is hardware-backed on devices that offer it. They are never written to the app database and never placed anywhere a log or a backup could read them back.

The database stores credential-free templates instead: a stream address with placeholders that are resolved in memory, at the moment you press play. Delete a playlist and its credentials are deleted with it, in the same action.

Virumo asks only for the permissions playback needs: the internet, and a notification so background audio can keep playing. In Android's terms that is INTERNET to reach the playlist, guide and streams you configure, POST_NOTIFICATIONS for the playback notification, and the two foreground-service permissions (FOREGROUND_SERVICE and its media-playback type) that Android requires for audio that keeps playing in the background.

There is no storage permission, no location, no contacts, no microphone and no camera, so there is nothing extra to revoke and nothing extra to misuse.

Virumo connects only to the servers you enter: your playlist host, your guide source and your provider's streams. There is no analytics endpoint, no crash reporter, no account service and no update ping of our own.

Two limits are worth stating rather than hiding. The Xtream protocol carries credentials inside stream URLs on the wire, which is a property of the protocol and not something a player can fix. And many panels only offer plain http, so the connection is unencrypted; Virumo tells you when it is connecting insecurely instead of pretending otherwise.

Stream addresses are checked against an allowlist of schemes: only http and https are played. A file:// or content:// entry is rejected, so a hostile playlist cannot point the player at your device's own storage.

Channel names, group names and guide text are rendered as text, never as markup or a path, so an entry cannot smuggle a script or a file reference into the interface. No playlist entry can reach stored credentials, whatever it claims to be.

Virumo is installed by sideloading, so the file you install matters. It is served only from this website, over HTTPS. When downloads open, the install page publishes the file's SHA-256 checksum, worked out from the exact file offered, with the commands to check it on Windows, macOS and Linux. If the checksum you compute does not match, do not install the file.

When you install the new file, Android also checks that it is signed with the same key as the app it replaces. If another site offers a Virumo download, do not install it.

If you believe you've found a vulnerability, a reporting address will be published on this page before launch. Until then this website has no route for reports. When it opens, please send enough detail for us to reproduce the problem, and give us a reasonable window to fix it before publishing it (responsible disclosure).

If you find something we've missed, we'd rather hear it from you than read about it.