Legal

Security

Report a vulnerability

Found a vulnerability? Please email security@playbridge.app rather than filing a public issue. Include the app, its version, your platform, and steps to reproduce.

PlayBridge is a small open-source project, so there is no fixed response time. Fixes ship in the next release of the affected app, and credits go in the release notes unless you ask otherwise.

Machine-readable contact details are in /.well-known/security.txt.

Scope

  • Android phone app (sender)
  • Android TV / Fire TV receiver and its GeckoView browser plugin
  • PlayBridge Desktop for macOS, Windows, and Linux
  • PlayBridge Video Detector browser extension (Chrome and Firefox)
  • The playbridge CLI and its installers
  • The iPhone, iPad, and Apple TV apps (TestFlight beta)
  • playbridge.app, including its download and update endpoints

Problems in third-party websites, bridged apps, services you connect yourself, or a TV's own DLNA software belong with their operators. The design does not try to protect secrets on a device whose operating system is already compromised (rooted or jailbroken).

Supported versions

PlayBridge ships 0.x Alpha releases, versioned separately for each app. Security fixes go into the latest release of each app and the main branch. Older releases do not get backports, so update to the latest release.

How pairing works

The first time a sender connects, the receiver shows the sender's name and a 6-digit code. Type that code on the sender. The request expires after 60 seconds, and the receiver can deny it.

Behind the code: both devices make fresh X25519 keys, and the sender commits to its key before seeing the receiver's. Each side derives the 6-digit code from the shared secret, so a device in the middle would make the two codes differ. After the code matches, the sender proves it holds the same key. The receiver then sends a token and its certificate fingerprint, encrypted with AES-256-GCM. The token never travels unencrypted.

After pairing

Senders and receivers talk only over WSS (TLS). Unencrypted control connections are refused, with no fallback. A paired sender checks the receiver's certificate against the saved fingerprint before it sends its token or any command. If the fingerprint changes, the connection stops and you pair again. Until a sender authenticates, a receiver accepts only pairing and sign-in messages.

The Android phone encrypts saved tokens with an Android Keystore key, and the iPhone app keeps them in the Keychain. Desktop and Apple TV receivers store a one-way verifier of each sender's token instead of the token itself.

Media is a separate path. Some media servers, especially local ones, use plain HTTP or self-signed certificates, so receivers can play them. That does not weaken the control connection.

Technical details

The full requirements are in the security standard. Known gaps and their fix order are tracked in public in SECURITY_GAPS.md.