Apeeye stores nothing on the server. Each visitor's data lives in their own browser, and the relay only forwards requests to the tab that owns a workspace. The security model is described in the README under "Security".

Please don't open a public issue for security problems.

Use GitHub's private reporting: go to the Security tab of this repository and click Report a vulnerability. If that isn't available, send a DM to @ibr0r on X.

Include what you found, how to reproduce it, and what you think the impact is. You'll get a reply. Fixes ship as a patch release and the report is credited in the changelog unless you'd rather it wasn't.

Things worth reporting:

• A way to read or write another workspace without knowing its id
• Serving HTML, scripts or redirects on the app's origin through a relayed response
• Bypassing the rate limits, body caps or in-flight caps
• Anything that makes the relay store or leak user data

Things that are by design and not vulnerabilities:

• Anyone holding a workspace URL can read and write that workspace, and can take it over from another tab. The id is the capability. Reset rotates it.
• Endpoints go offline when the owning tab closes.