KeyCream needs the Input Monitoring permission to hear key presses, so it is held to a high standard: it only reads which physical key was pressed, never what you type, and its only network requests go to GitHub, to check for and download updates.

Only the latest release receives fixes.

Please do not open a public issue for a security problem.

Report it privately through GitHub instead: open the repository's Security tab and choose Report a vulnerability, or go directly to the advisory form.

Include what you found, how to reproduce it, and which version you tested. You can expect a first reply within a week. Once a fix is released, the advisory is published with credit to you unless you prefer to stay anonymous.