I build a handful of privacy apps for GrapheneOS in my spare time, and this week the main one got some real security work, so I figured I'd share.
Parakeet is my fork of Molly. Molly hasn't had a release since July and is still on Signal 8.19.2, so I started pulling Signal's security fixes in myself. The big one was the RingRTC hot mic bug (CVE-2026-113380), where someone on a call could keep your mic on after you hang up. Molly still ships the vulnerable version, so I rebuilt their RingRTC with Signal's fix. I also backported 19 of Signal's other hardening commits from 8.19.2 to 8.33.1, mostly stricter checks on images, attachments, mentions and call messages. On top of that it has no Google push, screen security always on, and disappearing messages by default. It's still 8.19.2 underneath, so no new Signal features, just the fixes. It syncs with Molly every 6 hours and drops each patch once Molly catches up.
The other stuff, if any of it's useful to you:
Molevad VPN is my fork of the open-source Mullvad app with on-device tracker and SDK domain blocking added. DAITA still works.
Dodo Bird identifies birds by their songs and calls, fully offline with no internet permission, around 10,000 species with pictures. Built on BirdNET Live.
HawkEye logs every plane that flies over you, pings you as it passes, and ranks the regulars. Built on the airplanes.live app.
Everything's free and open source, and you can keep it updated with Obtainium or ObtainX: https://gitlab.com/LionNest
None of it is affiliated with Signal, Molly, Mullvad or the original projects. Happy to answer questions or hear if something breaks.