Skip to content

Security: XfLabs/techspeak-studio

Security

SECURITY.md

Security Policy — TechSpeak Studio

Privacy-First Architecture

TechSpeak Studio is designed with privacy as a default:

  1. Video stays local. Recorded video is stored in your browser's IndexedDB. It is never sent to any server unless you explicitly click "Upload to YouTube."

  2. Transcript is sent to AI only on demand. When you click "Get AI Coaching," the text transcript (not the video) is sent to the configured LLM endpoint. No data is sent automatically.

  3. No analytics or tracking. The app does not include any analytics, telemetry, or third-party tracking scripts.

  4. OAuth tokens are stored server-side. YouTube OAuth tokens are stored in a local SQLite database file. In production, this should be encrypted at rest.

Threat Model

Threat Mitigation
LLM API key leakage Key is stored in .env.local (server-side only), never exposed to the browser
YouTube OAuth token theft Tokens stored in SQLite on the server; use disk encryption in production
XSS via transcript Transcript is rendered as text content, not dangerouslySetInnerHTML
CSRF on API routes Next.js API routes use same-origin by default; YouTube OAuth uses state parameter
Video blob exfiltration Video never leaves the browser unless user explicitly uploads

Recommended Production Hardening

  • Enable HTTPS (required for getUserMedia in production)
  • Set Content-Security-Policy headers
  • Encrypt the SQLite database at rest (or use a secrets manager for OAuth tokens)
  • Set rate limits on /api/coach and /api/youtube/upload
  • Rotate YouTube OAuth client secrets periodically
  • Run the app behind a reverse proxy (nginx, Caddy)
  • Set X-Frame-Options: DENY and X-Content-Type-Options: nosniff

Supported Versions

Version Supported
0.1.x Yes (current)

Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

  1. Do NOT open a public GitHub issue.
  2. Email: [your-email@example.com] (replace with your contact)
  3. Include: description, reproduction steps, and potential impact.
  4. We will acknowledge receipt within 48 hours and provide a fix timeline.

Dependencies

We minimize dependencies intentionally. Key dependencies and their security posture:

  • next — actively maintained by Vercel
  • googleapis — official Google client library
  • better-sqlite3 — widely used, native SQLite binding
  • zustand — minimal state management (no network activity)

Run npm audit regularly to check for known vulnerabilities.

There aren't any published security advisories