Codecov incident
Codecov uploaders (Action/Orb/Step) fail gpg verification
Resolved on June 6, 2026.
On Saturday, June 6th, the Codecov gpg public key located at keybase.io/codecovsecurity was absent. This caused widespread outages for users uploading with the Codecov - GitHub Action - CircleCI Orb - Bitrise Step In order to quickly move and prevent further outages, the Codecov team deleted the `codecovsecurity` account and created `codecovsecops` with the same public gpg key. This key can be verified against any pre-existing CLI to prove it is the same key and also at about.codecov.io/security. The key location was updated in all of the above uploaders on the latest versions.
Update timeline
- resolved Jun 06, 2026, 01:00 PM UTC
On Saturday, June 6th, the Codecov gpg public key located at keybase.io/codecovsecurity was absent. This caused widespread outages for users uploading with the Codecov - GitHub Action - CircleCI Orb - Bitrise Step In order to quickly move and prevent further outages, the Codecov team deleted the `codecovsecurity` account and created `codecovsecops` with the same public gpg key. This key can be verified against any pre-existing CLI to prove it is the same key and also at about.codecov.io/security. The key location was updated in all of the above uploaders on the latest versions.
Your product runs on more than Codecov
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services