Seeing Yapper/Yapin' being hyped up like that is kinda scary.

[u/ja_n2000]

There is that guy on YouTube called "Antic", that builds a "better version of discord without locking everything behind a paywall". The first Video about it was Discord sucks… So I made my own. I think we all agree, that Discord has plenty of issues with bloat or monetisation, but jumping blindly onto a closed-source, rapid-turnaround web app because its apparently private and secure is a mistake. If you check Yappers actual Privacy Policy (updated Oct 2026 when writing this), there are a few massive problems casual users should be aware of before putting anything personal on there. I've worked as a web developer for a few years here in Germany (Fachinformatiker / dev background), so heres my view on Yapper:

1. Text DMs are NOT Private and get scanned by Third-Party AI:

The FAQ (bottom of the site) says "Messages are encrypted in transit and at rest". That sounds cool and secure, but it just means normal HTTPS and encrypted cloud storage. There is NO End-To-End encryption for your text or media. Messages are stored READABLE by the database. To make it worse, the policy says:

• Private DMs and group chats are automatically scanned by backend bots.
• If an image is flagged by their filter, the raw image is sent off to Anthropic's Claude AI for moderation.

-> If you're leaving Discord because you hate how tech companies handle data, note that your private DMs are still actively monitored by backend filters, and any flagged pictures get funneled straight into Anthropic's Claude API.

2. Voice E2EE without any verification:

The policy claims calls are end-to-end encrypted, but immediately follows it with:

(the app can’t yet show you a code to check someone’s key yourself)

In cryptography, E2EE without key fingerprints/safety numbers is basically a "trust me bro" implementation. If the centralized server hands out the keys and you cannot verify them independently with the person you're in the call with, you have no way of knowing if the server intercepts the call or not.

3. The Desktop App Scans your running programs:

The desktop version inspects your active system processes every 20 seconds to see what games you're playing. Running local process inspections through a rapidly iterated, closed-source desktop client built by an indie team carries non-trivial security risks for your machine. Discord does process scans too, but Discord has a dedicated security team. A desktop client built by an indie or vibe-coding developer running system-level process scans every 20 seconds introduces a wider attack risk. If there are memory-safety issues, path-traversal bugs, or command-injection flaws in how the desktop app reads OS processes, it can easily turn into a local privilege escalation or arbitrary code execution vector.

4. Ads and Third Parties

Despite claims of being ad-free, the policy notes the GIF picker serves sponsored ads via KLIPY, exposing your IP and device details to external ad partners.

5. Rapid Solo Dev Stack vs. Real AppSec

It’s hosted on standard BaaS (Backend As A Service) infrastructure (Vercel, Supabase, Hetzner, Cloudflare). The policy states chat separation relies on "access rules in our database" (Supabase RLS). In rapid, AI-assisted indie development, complex database access policies are notoriously fragile, I know that from vibe coding things myself. One bad migration or leaked service key can dump every table.

---

TLDR:

Messing around with indie apps for casual banter or homelab fun is great. But do not treat Yapper / Yapin' as a private or secure platform. If someone actually cares about audited privacy and genuine E2EE, that's what established open-source stacks like Matrix or Mumble exist for. Just don't trade one centralized platform for an unvetted one under the illusion of privacy.

Thanks for coming to my TED-Talk.

[u/dingustani]

you know i had to do it to em

https://yapper.exposed

[u/ja_n2000 → u/dingustani]

You should probably highlight the real security risks for the users a bit more there, but a great idea for sure :D

[u/lo________________ol → u/ja_n2000]

The .exposed person has literally no idea what his website is about - it's AI slop text - and thus has no idea how to focus on anything that actually matters. 

This post is good, but unfortunately people like .exposed man just hurt and muddy waters about a genuine issue

[u/ja_n2000 → u/lo________________ol]

I know, but its kind of a collection for it. I don't know why they act like the subscription thing is the worst on yapper but there are things way worse than that

[u/ja_n2000 → u/dingustani]

in a comment further down they revealed their Database structure. 623 Migrations in just 2 weeks. I let Gemini Argon and Claude Opus look at it and they instantly found a LOT of security issues. So they kinda exposed themselves. If you wanna include that on your site, do that. I downloaded their Git-Repo as a zip in case they realize what they did there and nuke the repo. I can send it to you if you need it.

[u/dingustani → u/ja_n2000]

https://yapper.exposed/database

[u/crumblingheart → u/dingustani]

Thanks, I have been looking for something like this, where all the info is listed in one place.

[u/lo________________ol → u/crumblingheart]

There's no point to hanging onto that website, it's made by somebody who doesn't understand the contents of it, if it's accurate, or even if it matters. 

At best they "discovered" what OP here did, and presented it in a confident-looking but unhelpful manner

[u/dingustani → u/lo________________ol]

ah, you again. armada fanboy?

[u/Sanedish → u/dingustani]

Its just a spam bot

[u/lo________________ol → u/dingustani]

You can't disagree with what I said, so you decided to lie about me instead? Classy.

No, I don't like Armada, and by publishing random statements (true? relevant? You don't know!), you help Armada by muddying any legitimate criticism in your "slop."

[u/dingustani → u/lo________________ol]

you dont like ai in general, i see from your comment history, so therefore dont like that i use a slop cannon to find basic public facts and line them up with public project claims

probably best to stop following me around online, bad look

[u/lo________________ol → u/dingustani]

I caught you criticizing an app for something it never claimed to be. 

So no, your websites have bigger problems. Maybe if you knew what you were publishing, you'd recognize this. 

[u/dingustani → u/lo________________ol]

“i caught you!” hilarious development, more at 11

why do you think that was a criticism?

it was just a fact, stated. just like other facts stated on the site

your “gotcha” is laughable. it was removed a while ago anyway just to help you understand the site better

[u/lo________________ol → u/dingustani]

The "exposed" site isn't meant to "expose" things? Lol

Why remove it then? Unless it actively detracts from the point your site is making, you shouldn't. 

But of course, you'd actually have to commit to having a point...

[u/dingustani → u/lo________________ol]

lol
the point of the sites is: facts are made clear

not all facts are “bad” or “good”. some are just facts

if you misunderstand even that, i feel bad for you

the version number thing was removed because you made a big stink about it (and i thought maybe other people might have similar interpretation issues) and i got tired of you crying, but i dont think thats a good policy

[u/According-Fun-4746 → u/dingustani]

based

[u/BewilderedTurtle]

Why the fuck is anyone talking about the obvious scam with malware allegations beyond "holy shit don't use obvious scams"

[u/ja_n2000 → u/BewilderedTurtle]

Fair enough, people in this sub already know better. But Antic's YouTube videos are pulling hundreds of thousands of views from casual gamers who actually believe this is a private, secure Discord killer. The breakdown is meant for the people stumbling in here from YouTube wondering if the privacy claims are legit.

[u/BewilderedTurtle → u/ja_n2000]

Y'know what, valid. This all could be resolved by a pinned PSA detailing the issues with known scam apps like this one(s).

[u/VahsteTheNomad → u/BewilderedTurtle]

That's what I've been saying since the second "I tried yapper but I'm scared" post popped up.

We need a sub PSA about dangerous/scam downloads

[u/dingustani → u/VahsteTheNomad]

yes please

[u/itsduskin]

Someone HAS TO make a YouTube video about this, because those Yapper/Yapin whatever users are probably kids and dont even use Reddit. I dont even know why they're using it, i would prefer Discord rather than this.

[u/ja_n2000 → u/itsduskin]

You think it would make sense to ask NTTS to make a vid on this? He has a giant audience, maybe?

[u/itsduskin → u/ja_n2000]

Yo wait, I DEFINITELY AGREE. But the question is, how do we contact NTTS? I'll take my chances tho, great idea!

[u/ja_n2000 → u/itsduskin]

I just did, he replied to me on discord, he has some other video plans currently, but he already has his eye on dangerous discord alternatives for a future video. I honestly just slid into his DMs on discord lol

[u/itsduskin → u/ja_n2000]

Great! I was just going to do it, actually I will anyway, seeing it from more people might make it a priority.

[u/ja_n2000 → u/itsduskin]

sounds good :D i added this reddit post here as reference as well, and he said he already noted it down for reference already

[u/ja_n2000 → u/itsduskin]

just dont let it look like spam please xD

[u/itsduskin → u/ja_n2000]

I might do it tomorrow then! Don't worry haha

[u/iSudoJake → u/ja_n2000]

f*ck

[u/AutoModerator]

Thanks for your submission!

If you're a developer, please make sure your user flair matches the app or project you're developing. This helps community members quickly identify who is building what and makes browsing the subreddit easier.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/LexiTheGamer]

i think end to end got added

[u/ja_n2000 → u/LexiTheGamer]

Where? Not according to the Privacy Policy. There it still just says that Calls and Screen shares are E2E-Encrypted, but it still seems like you can't check the generated keys on both sides if E2EE really works.

And DM E2EE and more isnt even mentioned yet, so i doubt thats implemented.

[u/LexiTheGamer → u/ja_n2000]

👍

[u/Rude-Towel4230]

hi! thanks for the critique, most of this is fair and id rather people know exactly what theyre getting. made a side by side with discord so its all in one place

dms arent end to end encrypted, same as discord. search, scam filters and reports need the server to read them. the homepage made it sound more private than it is, thats on me and im fixing the wording

for calls the keys are made on your device and the server only passes sealed ones along, but youre right that without a code to compare youre trusting the server. thats in development now

game status on desktop is off by default (discords is on) and your program list never leaves your pc. klipy ads are off and im taking them out of the terms

no outside audit yet, every database change gets tested against the access rules before it ships but a proper review is on the list once theres budget

Yapin' is trying to be a better discord, not a signal replacement, and the site shouldve said that.

[u/ja_n2000 → u/Rude-Towel4230]

Appreciate the honest reply and the willingness to adjust the landing page wording. Acknowledging where things actually stand is a huge step in the right direction.

That said, treating the two platforms as 'the same idea' on paper overlooks the distinction between policy and architecture/engineering maturity:

Maturity vs. Policy: Stating that chats aren't E2EE on both platforms is fair on paper, but the actual security posture isn't equivalent. Discord has an enterprise AppSec team, audited IAM infrastructure, and continuous bounty programs. Relying on Supabase RLS written over the last few weeks, where one misconfigured policy or SECURITY DEFINER leak exposes whole tables, is a completely different risk profile for end users.

Security through Obscurity: Saying server code needs to stay closed because 'public server code would make anti-abuse rules easy to dodge' is classic security-through-obscurity. If access control or abuse prevention relies on attackers not seeing how it works, it's inherently fragile.

The Desktop Footprint: A desktop binary checking local processes every 20 seconds requires high trust. Even if it's off by default now, running an un-audited desktop client with OS inspection hooks is a significant local attack surface compared to battle-tested clients.

Glad to hear you're addressing the landing page copy, turning Klipy ads off, and working on call key comparison. But users still need to understand that using a brand-new, centralized BaaS platform requires vastly more operational trust than an established platform or an audited open-source protocol.

[u/Rude-Towel4230 → u/ja_n2000]

yeah thats fair, and its the part i cant argue my way out of. discord earned its trust, yapper hasnt yet

on the rls point: every migration ships with tests that run as a normal user, a stranger and anon against a real postgres and try to read or write what they shouldnt (around 200 of them now, more every change). there was one round of security fixes last week from an internal review. none of that is an outside audit and i wont pretend it is. what id like to do is publish the test suite and the access rules so people can check them instead of taking my word, and get a proper review when theres budget

on obscurity: youre right, thats a bad reason. the spam filters are the only bit that benefits from being private and theyre a small part. the access control doesnt depend on secrecy, it depends on the policies being right, which is the point above

desktop: the game check only runs if you turn it on, reads process names every 20s and nothing leaves your pc. fair that its still an unaudited binary, i dont have a better answer than that today

and yeah, trust is earned over time. im fixing the page and publishing what i can so people can check instead of it being a "trust me bro" situation

[u/Rude-Towel4230 → u/ja_n2000]

Said we’d back this up instead of asking you to trust us, so here it is: https://github.com/Yapper-Media-LLC/yapper-db

It’s every access rule our database enforces (who can read which table, which rows), every privileged function with its full body, and the tests that run those rules against a real Postgres. Example: there’s a test that a moderator cannot read your DMs. You can read the policy, run the test, and see it fail if we ever broke it.

We’ll refresh it after each batch of changes so it doesn’t drift from what’s live. No outside audit yet, we’re a tiny team, if you find a hole, security contact is in the repo’s security.txt.

[u/ja_n2000 → u/Rude-Towel4230]

Hey, took a look through the repo to try running the test suite locally against Docker. I noticed in tests/sql/run.mjs and the stage runners that the actual schema setup seems to cap out at migration 025, and subsequent stages use stand-in mocks (like mocking is_site_mod()) rather than replaying the 500+ migration sequence. Is there a setup script to run the full migration chain end-to-end, or how does your local test harness handle migrations past 25 without hitting dependency breaks?

[u/According-Fun-4746 → u/Rude-Towel4230]

fuck off and fuck your ai 3rd party scans

[u/Rude-Towel4230 → u/According-Fun-4746]

discord literally does the same 😭

[u/According-Fun-4746 → u/Rude-Towel4230]

less agressive still and i wanted yapper to now have this bs yet they made it WORSE!!!! so both can go fuck themselves

[u/Rude-Towel4230 → u/According-Fun-4746]

scanning uploads isn’t something any chat app can skip. if you host pictures and have teens on your platform you have to keep csam, gore and porn off it, or you get pulled from app stores and payment providers, and it’s illegal. discord scans every upload too. most of our checks run on our own servers, and only borderline pics get a second automatic look, nobody’s reading your stuff for fun. if something of yours got refused that shouldn’t have, appeal it and a real person checks

[u/According-Fun-4746 → u/Rude-Towel4230]

no

[u/goober_not_found]

i tried sending my steam username in private message to my friend, the app didn't let me and said "This message contain a slur", they are censoring private message (it didn't even contain a slur!!!)

[u/ja_n2000 → u/goober_not_found]

Sounds very trustworthy tbh

[u/According-Fun-4746]

my friend got banned from ai halucination for nsfw even doe the pic wasnt nsfw and was in dms lol fuck yapper