Skip to main content

Artemis

Artemis Security Update: Nov. 10 2026

The email below was sent on November 10th, 2026, to all Artemis users who have provided an email address.


This security update is being sent to all users with a registered Artemis account.

At approximately 11am on Tuesday, November 10th, 2026, while working on Artemis, I discovered that Artemis public API keys could be used to access endpoints where a private API key was required. Immediately after discovery, a patch was released to rectify this issue.

If you have never shared your Artemis public key, you are not affected by this issue.

It was then decided that, due to low usage of the API, the API should be disabled. This work is now complete. Artemis no longer offers an API, and all API keys in our database have been changed.

Please note that email, password, one-time password codes, authentication information, and account preferences (i.e. timezone choice, reader configuration options) were not affected by this issue. No API endpoints have ever been available to access these pieces of information.

About the issue

Public API keys were designed to let you search only feeds that you have opted to make searchable with your API key, whereas private API keys give access to:

  • An RSS version of your main feed, including, but not limited to, URLs, titles, and contents of posts from sites to which you are subscribed;
  • A JSON version of your main feed, including, but not limited to, URLs, titles, and contents of posts from sites to which you are subscribed;
  • The ability to search posts in your feed, and;
  • Access to your link graph.

The security issue I discovered means that if you shared a public API key with anyone (including on the open web), that key could in theory have been used to access the information above.

I have been unable to trace the exact date that the issue was introduced, only that it has been a problem for at least nine months.

Am I affected?

If you have never shared your Artemis public key, you are not affected by this issue.

If you have shared your Artemis public key, you may have been affected. But, due to how logs are stored, it is impossible to trace if any particular user's data has been accessed. This email is therefore being sent to every user out of an abundance of caution.

Of note, I have received no reports indicating this vulnerability has been exploited. Access logs for the last two weeks show no signs of exploitation, and, overall, limited API usage. Retrieval of RSS feeds cannot be reliably accessed however, to the extent I can see from my analysis, no successful attempts have been made to retrieve an RSS version of a user's feed in the last 14 days. But, given the issue in the Artemis codebase has been present for at least nine months, it cannot be guaranteed the issue has not been exploited.

Apology

I (James, the creator of Artemis) sincerely apologise for the oversight that led to this issue. Artemis is maintained as a hobby project, but that doesn’t excuse the logic error in the code that caused this problem. I want to take this time to remind you that you can delete your account at any time from the “Delete account” setting in your account settings.

If you have any questions or concerns, please don’t hesitate to email me at artemis@jamesg.blog.