If You Received Supercut's November 2026 Security Notice: What It Means and a Local Alternative

Supercut's founders, David Okuniev and Neil Kinnish, emailed customers about a security issue they say has now been resolved. The notice is specific about what was exposed, what the key could and could not do, and what the company has already changed. That kind of direct update is worth crediting.

As of November 11, 2026, the same text does not appear on Supercut's blog, changelog, or public help center, so the Supercut details below are taken from Supercut's emailed customer notice, November 2026. Blacksmith, the CI build tool named in that notice, did publish a public status update on November 6, 2026.

If you want the next recording to stay on your computer, and to share it through your own Google Drive, ScreenKite is the option we recommend.

What happened

On November 5, 2026, Blacksmith says an unauthorized party accessed the system that stores the console output (job logs) of CI jobs run on its runners. In its status notice, Blacksmith says the access was revoked the same day, a later attempt by the same party to regain access was blocked, CI execution was not affected, and at that time there was no evidence that customer exposure went beyond the job-log store. The incident impacted job-log data belonging to approximately 2.6% of Blacksmith's customer accounts, and Blacksmith says it contacted each of those customers. Its investigation was still ongoing when the notice was posted.

Supercut's emailed customer notice, November 2026, signed by David Okuniev and Neil Kinnish, Founders, FloatLabs / Supercut, fills in what that incident meant for Supercut. It says a breach at Blacksmith.sh, a tool they use to build their software, exposed one of their private keys for accessing recordings. On November 8, Blacksmith informed them that the signing key had been printed in five of their deployment runs between October 29 and November 4, and that at least three of those log lines were returned. Supercut says it replaced the key the morning it found out, at 08:22 UTC on November 8, and has found no evidence the key was used.

What it means for you

These limits come from Supercut's notice, not from inference:

• The key could have been used to create links that read recording files.
• It could not change or delete those files.
• Opening any recording would also have required that recording's identifiers.
• The key offers no way to list files.

Supercut says it has found no sign that the key was used. Traffic and failed-request levels on the service that delivers recordings "stayed within the normal range of the previous four weeks, with no pattern of crawling, enumeration or mass download." Since November 8, the company says it has logged every request. Every request carrying the old key has been rejected, and all of them came from links their own app created earlier.

The notice also states a limit on that conclusion: request-level access logs were not enabled on the service that delivers recordings before November 8, "so we cannot fully rule out a small number of targeted requests before then." That is a gap in the log history, not evidence that those requests happened.

What Supercut has done

According to the same notice, Supercut has:

• Replaced the signing key and deleted the old one
• Fixed the deployment step so it no longer prints the key
• Rotated the other credentials used by its deployment pipeline preemptively
• Turned on request-level logging for the service that delivers recordings (since November 8)
• Added alerts on changes to signing keys and key configuration
• Enabled automatic detection and alerting of secret-like output in its CI logs
• Moved its CI off Blacksmith

If you have questions, the notice asks you to get in touch through the chat in your Supercut workspace. Okuniev and Kinnish say they and the team are on hand to answer them directly. Supercut's team page lists both as founders of FloatLabs.

What you can do if you use Supercut

The notice does not ask customers to take a required action, and the steps below are general suggestions, not instructions from Supercut.

• Read the emailed notice in full, including the part about logs before November 8.
• Ask any remaining questions through the chat in your Supercut workspace, as the founders request.
• Review the share links you have already sent, especially for recordings that contain internal or customer information.
• If your workspace lets you replace or re-share a recording, consider doing that for the most sensitive videos, then retire the older links.
• Keep a local export of anything you would want to hold independently of a hosted player.

None of this is a claim that a recording was opened by someone who should not have seen it. Supercut says it has found no evidence the key was used.

A local alternative: ScreenKite

If you would rather keep the next recording on your computer, ScreenKite records on your machine, edits on a real multi-clip timeline, and exports an MP4 you control. You share through your own Google Drive. The file does not have to sit on a vendor's recording-delivery service for someone to watch it.

ScreenKite is a native screen recorder for macOS (macOS 15 or later, Apple Silicon and Intel) and Windows, free to use with a watermark on exports, and a one-time Pro purchase that removes it. ScreenKite Pro is one payment of $99.99 for 3 devices and never renews. An account is required. The AI fee is $0.

People at Apple, Reddit, HubSpot, and GitHub use ScreenKite. See screenkite.com.

How it is built

Back then I couldn't make the edits I needed in a screen recorder, so the clip went to Final Cut, the cuts were fixed, the animations broke, and the clip was exported again. Two tools, two payments, one afternoon gone. ScreenKite is the tool I wanted that day.

• Record and edit in one app. A real multi-clip timeline is built in, so the whole video is finished in one place. On macOS, ScreenKite saves recordings as MP4 by default.
• Every editing feature is free. Free exports carry a watermark and an outro. Pro removes them.
• Pay once. One payment of $99.99 covers 3 devices and never renews. There is no subscription.
• Bring your own AI agent. Claude Code, ChatGPT Codex, Antigravity, Grok Build or Kimi drive the editor over MCP or the CLI. The ScreenKite AI fee is $0; your agent provider may charge for its own plan.
• 83 purpose-built editing tools, shaped by tens of thousands of hours of video-editing practice.
• Share from your own Google Drive.
• Native macOS and native Windows.

Any downsides? The only downside is there's almost no downside, because we're video creators ourselves and know what users need.

ScreenKite runs natively on macOS and on Windows. It's lightning fast, in our tests and in user feedback, and you edit on the timeline with the AI agent you already use: Claude Code, ChatGPT Codex, Antigravity, Grok Build or Kimi. Describe the cut, and the agent does the trims.

Supercut vs ScreenKite

Facts

• Product: ScreenKite
• Platform: native macOS (macOS 15 or later, Apple Silicon and Intel) and native Windows
• Price: Free to use with a watermark and outro on exports. One payment of $99.99 removes them, covers 3 devices and never renews. An account is required.
• AI: bring your own agent: Claude Code, ChatGPT Codex, Antigravity, Grok Build, Kimi. AI fee $0.
• Checked: 2026-11-11

FAQ

Was a Supercut recording shown to have been opened with the old key?

No. Supercut's emailed customer notice, November 2026, says the company has found no evidence the key was used, and that traffic and failed-request levels stayed within the normal range of the previous four weeks. It also says request-level access logs were not enabled before November 8, so a small number of targeted requests before then cannot be fully ruled out.

What could the exposed key do?

Per the notice, it could have been used to create links that read recording files. It could not change or delete those files, it could not list files, and opening any recording would also have required that recording's identifiers.

What should I do if I am a Supercut customer?

Start with the official path in the notice: use the chat in your Supercut workspace. As a general suggestion, review existing share links, consider re-sharing sensitive recordings if your workspace allows it, and keep a local export of videos you want to hold yourself.

Did Blacksmith publish anything about this?

Yes. Blacksmith posted a public status notice on November 6, 2026, and its official account shared the same opening facts on X. That notice covers the job-log store. It does not name Supercut.

Why use ScreenKite after reading this notice?

If you want the recording to stay on your computer and to share a link from your own Google Drive, ScreenKite is built that way. Every editing feature is free, and one payment of $99.99 for 3 devices removes the export watermark and never renews.

Bottom line

Supercut's founders told customers what was exposed, what the key could not do, what they have already fixed, and where the log history is incomplete. That is a clear notice. If you would rather record and edit locally, and share through your own Google Drive, try ScreenKite.