VRization defaults to authorized USB connections, with a trusted-LAN alternative. The host sends its selected display / region to one connected viewer. The Windows GUI's First-person gyro preference defaults to enabled; validated session/mode/pose and local stop gates still control every output. Pairing or discovery alone does not start capture or mouse input.
- Android USB requires a data cable, USB debugging and the phone's approval of this PC. Use official Platform Tools and an appropriate OEM driver; VRization does not install a driver, root a phone or change debugging authorization. It excludes emulator / wireless transports, uses
--no-rebind, and removes only its own still-matching reverse mapping. - Android bootstrap returns a code only while an authorized physical USB mapping is owned. It requires a loopback peer, a single loopback Host / allowed port, no Origin header, and a running host. Replies use
no-store/nosniff; there is no CORS permission. It is disabled by default in embedded hosts. These checks do not protect against malicious software already running on the PC with local access. - iOS USB requires Apple Mobile Device support and an existing local trust pairing record. The app listens only on phone loopback while foreground; Windows checks USB connection type and reads the pairing record before connecting. VRization does not send Pair / Trust / SavePairRecord, request Apple credentials or save / display pairing-record keys. This is not a claim of an independently audited cryptographic trust protocol.
- USB uses the platform's authorized tunnel, without adding application-level encryption. The GUI host still listens on its configured network interface (default
0.0.0.0:8765); selecting USB on the phone does not disable the LAN listener. USB requires no inbound LAN firewall rule. Keep unnecessary LAN access blocked. - LAN WebSockets are unencrypted (
ws://); network attackers can potentially read images, settings and the code. - A six-digit pairing code is basic access control, not TLS, strong authentication or a trusted network.
- Do not forward ports, expose the host to the internet or use public Wi-Fi.
- Allow only necessary private-network firewall access and stop streaming when finished.
- Close private windows before sharing. A capture region can reveal other content after windows move.
Do not publish authenticated WebSocket URLs, pairing codes, device serials, Apple pairing records, signing certificates or provisioning profiles in diagnostics. The iOS relay reports safe HTTP status / connection failures without including its authenticated URL. Bounded USB frames and v1 message validation reduce malformed-input exposure; they do not replace review of a concrete build. See USB setup, protocol and validation.
Windows enables First-person gyro mouse control by default. A validated connection, First-person mode, available capture and fresh valid rotation data are required; the first pose sets a baseline before movement. Control works on the desktop, ordinary applications, games and VRization's own window regardless of foreground-window changes, with no five-second target-window deadline. A temporary sensor gap stops output and rebaselines on fresh poses before continuing. F8, the PC emergency stop, editor entry, PC Reset all settings, capture-region selection, capture/input failure and stream Stop latch a pause: late poses, settings and reconnecting cannot clear it. Click Resume gyro control on the PC, or explicitly turn the control checkbox off and on, to resume. Full screen and Cinema stop mouse output. The PC saves only the enabled preference, never the live armed state or pause latch. There is no remote arm/resume message. Phone backgrounding or language changes end its session and require explicit reconnection. Games may reject system mouse input; VRization does not bypass game protection.
The Windows target is 10 / 11 x64. Recorded local tests use Windows 11. Huawei Android hardware evidence and the iOS fake-usbmux / Simulator evidence are separate; no physical iPhone, real FPS game or viewer-optics security / compatibility pass is implied.
Use Issues for ordinary bugs. For pairing bypass, unauthorized input, code execution or screen leakage, prefer Security → Report a vulnerability when the maintainer enables private reporting. If unavailable, email lexzeonstudio@gmail.com privately; do not publish exploits, private data or pairing codes in public Issues.
This alpha has no formal security-maintenance SLA. Include version, OS, minimal reproduction conditions and possible impact, with real IP addresses, codes and private screens removed.
Editor dragging sends no settings and writes no preferences. Phone poses pause; entry drops application-pending pose work (already submitted transport bytes cannot be recalled) and sends editing: true. Both phone and PC editor entry latch host input off, while video/ping may continue. Leaving, Save, Discard, recenter, settings and reconnect do not clear that latch; use Resume gyro control on the PC. Committed profiles restore only after validated hello; pairing secrets remain excluded. PC Reset latches input paused and restores the default-enabled preference and Full screen, without granting platform trust. Capture display/region and ADB path remain selected; phone reset disconnects without immediately reconnecting. See editor scope.
VRization 默认已授权 USB 连接，也可选择可信局域网；电脑把所选显示器／区域发给一个观看端。Windows 界面第一人称陀螺仪偏好默认启用，每次输出仍受合法会话、模式、姿态与本地停止门控。单纯配对或发现设备不启动采集或鼠标。
- Android USB 要求数据线、USB 调试及手机对电脑的授权。使用官方 Platform Tools 和合适的 OEM 驱动；VRization 不安装驱动、不 root 手机、不改变调试授权。排除模拟器 / 无线连接，使用
--no-rebind，只移除仍匹配的自有 reverse 映射。 - Android bootstrap 只在主机拥有已授权真实 USB 映射时返回配对码；要求回环来源、单个回环 Host / 允许端口、无 Origin 及主机运行。响应使用
no-store/nosniff，不授予 CORS；嵌入主机默认关闭。这些检查不防御已经在电脑本地运行、具备本机访问能力的恶意软件。 - iOS USB 要求 Apple Mobile Device 支持及已有本地信任配对记录。手机只在前台监听回环，Windows 检查 USB 类型并读取配对记录后连接。VRization 不发送 Pair / Trust / SavePairRecord，不索取 Apple 凭据，不保存 / 显示配对记录密钥；这不代表一个已独立审计的密码学信任协议。
- USB 使用平台授权隧道，没有额外应用层加密。界面主机仍监听已配置网络接口（默认
0.0.0.0:8765）；手机选择 USB 不会关闭局域网监听。USB 无需开放局域网入站防火墙端口，保持不必要的网络访问被阻止。 - 局域网使用明文 WebSocket (
ws://)；画面、设置和配对码可能被同网段攻击者读取。 - 六位配对码是基础访问控制，不能替代 TLS、强身份认证或可信网络。
- 不要在路由器上做端口转发，不要直接暴露到公网，也不要在公共 Wi-Fi 上使用。
- 防火墙只允许必要的专用网络。结束使用后停止串流。
- 共享电脑画面前关闭不想暴露的窗口；选区可能因窗口移动而显示其他内容。
诊断中不要公开带认证的 WebSocket 链接、配对码、设备序列号、Apple 配对记录、签名证书或描述文件。iOS 中继只报告安全的 HTTP 状态 / 连接错误，不包含认证 URL。USB 长度限制与 v1 校验减少畸形输入风险，不能代替具体发行构建审查。参见 USB 教程、协议、验证记录。
Windows 默认开启第一人称陀螺仪鼠标控制。必须有通过校验的连接、第一人称模式、可用采集与新的合法旋转姿态；首条姿态先建立基准，再产生移动。桌面、普通应用、游戏和 VRization 自身窗口均可控制，不受前台窗口切换影响，也不要求五秒内切到目标窗口。传感器短暂间断时停止输出，新姿态先重建基准再继续。F8、电脑紧急停止、进入编辑器、电脑重置全部设置、选择采集区域、采集／输入故障和停止串流会锁定暂停；迟到姿态、设置与重连都不能解除。需要在电脑点“恢复陀螺仪控制”，或主动关闭再开启控制复选框。全屏和大屏幕停止鼠标输出。电脑只保存启用偏好，不保存实时授权状态或暂停锁。 没有远程授权／恢复消息。手机进入后台或切换语言会结束会话，需主动重新连接；游戏可能拒绝系统鼠标输入，VRization 不绕过游戏保护。
Windows 目标为 10 / 11 x64，本地已记录测试来自 Windows 11。华为 Android 硬件证据与 iOS 假 usbmux / 模拟器证据分开记录，不表示真实 iPhone、真实 FPS 游戏或盒子镜片的安全 / 兼容性已经通过。
普通功能问题请开 Issue。涉及绕过配对、未授权输入、远程代码执行或画面泄漏的问题，请优先使用 GitHub 仓库 Security → Report a vulnerability（仓库维护者启用私密报告后可用）。若入口尚未启用，请私下发邮件至 lexzeonstudio@gmail.com，不要在公开 Issue 中发布利用步骤、个人数据或配对码。
该 Alpha 没有正式安全维护 SLA。报告中请包含版本、操作系统、最小复现条件和可能影响，移除真实 IP、配对码和屏幕私密内容。
编辑拖动不发设置、不写偏好。手机暂停姿态并丢弃应用层待发姿态（已提交传输层字节无法撤回），进入时发送 editing: true。手机与电脑进入编辑器均锁定暂停主机输入，视频／ping 可继续；退出、保存、放弃、回正、设置和重连不解除锁，须在电脑点“恢复陀螺仪控制”。已提交配置只在合法 hello 后恢复，排除配对秘密；电脑重置锁定输入暂停，恢复默认启用偏好和全屏，不授予平台信任。保留采集显示器／选区及 ADB 路径；手机重置断线且不立即重连，见 编辑范围。