TechSpeak Studio is designed with privacy as a default:
-
Video stays local. Recorded video is stored in your browser's IndexedDB. It is never sent to any server unless you explicitly click "Upload to YouTube."
-
Transcript is sent to AI only on demand. When you click "Get AI Coaching," the text transcript (not the video) is sent to the configured LLM endpoint. No data is sent automatically.
-
No analytics or tracking. The app does not include any analytics, telemetry, or third-party tracking scripts.
-
OAuth tokens are stored server-side. YouTube OAuth tokens are stored in a local SQLite database file. In production, this should be encrypted at rest.
| Threat | Mitigation |
|---|---|
| LLM API key leakage | Key is stored in .env.local (server-side only), never exposed to the browser |
| YouTube OAuth token theft | Tokens stored in SQLite on the server; use disk encryption in production |
| XSS via transcript | Transcript is rendered as text content, not dangerouslySetInnerHTML |
| CSRF on API routes | Next.js API routes use same-origin by default; YouTube OAuth uses state parameter |
| Video blob exfiltration | Video never leaves the browser unless user explicitly uploads |
- Enable HTTPS (required for getUserMedia in production)
- Set
Content-Security-Policyheaders - Encrypt the SQLite database at rest (or use a secrets manager for OAuth tokens)
- Set rate limits on
/api/coachand/api/youtube/upload - Rotate YouTube OAuth client secrets periodically
- Run the app behind a reverse proxy (nginx, Caddy)
- Set
X-Frame-Options: DENYandX-Content-Type-Options: nosniff
| Version | Supported |
|---|---|
| 0.1.x | Yes (current) |
If you discover a security vulnerability, please report it responsibly:
- Do NOT open a public GitHub issue.
- Email: [your-email@example.com] (replace with your contact)
- Include: description, reproduction steps, and potential impact.
- We will acknowledge receipt within 48 hours and provide a fix timeline.
We minimize dependencies intentionally. Key dependencies and their security posture:
next— actively maintained by Vercelgoogleapis— official Google client librarybetter-sqlite3— widely used, native SQLite bindingzustand— minimal state management (no network activity)
Run npm audit regularly to check for known vulnerabilities.