Is Voicy - Voice to Text Powered by AI safe?

Medium risk

Voicy uploads user-triggered microphone recordings with the current site hostname to its transcription API.

When a user starts recording from an input field or shortcut, Voicy records microphone audio and sends it to apipishi.usevoicy.com for transcription, translation, or AI processing. The upload includes the current page hostname, an anonymous identifier, and optional language settings; the extension also generates a browser fingerprint used as a tracking identifier for userapi.usevoicy.com calls.

Kourosh Ghaffariv2.3.0Chrome Web Store
48Risk
Who publishes it

Kourosh Ghaffari - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Kourosh Ghaffari
Website
usevoicy.com/legal-pages/support

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Voicy ships one shared API key hardcoded in the extension for every install

Voicy's background script assembles one API key from four text fragments and uses it on every transcription request.

The key is identical in every install, so anyone can extract it from the shipped code and call Voicy's backend with it.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You click the Voicy microphone on a page and speak to transcribe audio.

The extension did this

The extension attaches a fixed API key, the same one shipped in every install, and uploads your recording to Voicy's transcription server.

The key never varies between users or installs.

The code that does this

background.js assembles the key and hands it out to any caller

Readable version

Key assembled from string fragments

const VOICY_API_KEY = [  "61d62a10",  "-cede-4c74",  "-bfa5-ea57",  "ac17d521",].join("");// VOICY_API_KEY === "61d62a10-cede-4c74-bfa5-ea57ac17d521"

Key handed out to whichever page asks

if (message.action === "getKoalaFarts") {  sendResponse({ farts: VOICY_API_KEY });  return true;}

Key attached to the outbound upload

fetch(uploadUrl, {  method: "POST",  headers: { "x-api-key": message.key },  body: formData,});
The code that does this

content.js collects the key on load and carries it into every recording

Readable version

Key requested when the page loads

chrome.runtime.sendMessage({ action: "getKoalaFarts" }, (response) => {  apiKey = response.farts;});

Key sent back to background.js with the recording

chrome.runtime.sendMessage({  action: "processAudio",  audio: recordingDataUrl,  key: apiKey,  url: uploadUrl,  hostname: window.location.hostname,}, (response) => {  // handle transcription result});
Where the key and your recording go
    • apipishi.usevoicy.com

    Voicy's transcription backend. Receives the uploaded audio and the fixed x-api-key header sent by every install.

Reproduce it yourself

Reassembles the API key from the same string fragments shipped in background.js, showing the key is retrievable directly from the extension's own code.

Requires
  • Node.js 14+
voicy-key-extract.js · js
// Reassembles the Voicy API key from the fragments shipped in background.js.const fragments = ["61d62a10", "-cede-4c74", "-bfa5-ea57", "ac17d521"];const apiKey = fragments.join("");console.log(apiKey);console.log(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(apiKey)  ? "well-formed key"  : "unexpected format");
How to run it
  1. 1Save as voicy-key-extract.js.
  2. 2Run node voicy-key-extract.js.
  3. 3Confirm it prints the same key found in background.js.

What it can do

Permissions this extension asks for, as declared in version 1.9.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 2.3.0, which we have not unpacked yet.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on googleapis.com

    https://*.googleapis.com/*

  • Read and change your data on api.usevoicy.com

    https://api.usevoicy.com/*

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Sign you in with your Google account

    identity

  • Run hidden pages in the background

    offscreen

  • Run its own code inside the pages you visit

    scripting

  • Show a panel beside the page

    sidePanel

Where it sends data

Destinations our analysis observed Voicy - Voice to Text Powered by AI contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • apipishi.usevoicy.com

    Voicy - Voice to Text Powered by AI sends data to apipishi.usevoicy.com. No other extension we have analysed sends data here.

  • userapi.usevoicy.com

    Voicy - Voice to Text Powered by AI sends data to userapi.usevoicy.com. No other extension we have analysed sends data here.

Updated 30 September 2026hgegmplalfpnkfahiikedaghinbocfdd