Security
Attack surface
The application is entirely client-side. There is no backend, no database, no authentication and no API. Nothing is transmitted at runtime, so there is no data in transit to intercept and no server-side store to breach.
Data at rest
Recorded sessions live in IndexedDB in your browser profile, and preferences in localStorage. Both are protected by your browser’s same-origin policy and by whatever protects your device. Neither is encrypted at the application layer. Anyone with access to your unlocked machine and browser profile can read them.
Liveness is not an anti-spoofing control
The liveness score is a signal-to-noise check in the cardiac band. It has not been tested against presentation attacks, and by construction it cannot reject a video replay of a real person, because a replayed video carries that person’s real pulse. Do not use it as an access-control mechanism.
Reporting an issue
You can get in touch via the contact form on deb0.com. Please do not include exploit details in a public channel.