# Codecov uploaders (Action/Orb/Step) fail gpg verification

- Provider: [Codecov](https://down.guide/providers/codecov)
- Confidence: Confirmed
- Impact: Operational
- lasted 0m
- started 2026-06-06 13:00 UTC
- id: DWN-d235e17117
- Official page: https://stspg.io/shqxdvymy18r

## Updates from Codecov
### 2026-06-06 13:00 UTC: resolved
On Saturday, June 6th, the Codecov gpg public key located at keybase.io/codecovsecurity was absent. This caused widespread outages for users uploading with the Codecov
- GitHub Action
- CircleCI Orb
- Bitrise Step
In order to quickly move and prevent further outages, the Codecov team deleted the codecovsecurity account and created codecovsecops with the same public gpg key. This key can be verified against any pre-existing CLI to prove it is the same key and also at about.codecov.io/security. The key location was updated in all of the above uploaders on the latest versions.

From the builder: does your app depend on Codecov? [Sazabi](https://www.sazabi.com/?utm_source=down-guide&utm_medium=markdown&utm_content=codecov) detects problems in your own logs without hand-written monitors, and you can ask it in plain language which errors mention Codecov.

---
down.guide reads providers' official status pages every minute and adds its own evidence, always labeled. Free, no account. Agents: MCP at https://down.guide/mcp, REST at https://down.guide/api/v1, feeds at https://down.guide/feed. Built by [Sazabi](https://www.sazabi.com/?utm_source=down-guide&utm_medium=markdown&utm_content=DWN-d235e17117), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.