SECURITY

Browser permissions.
Guest access.

The controls and limits in the Windows desktop alpha.

Website permission request
studio.example
CameraRequest accessBlocked
Browser permissions APP POLICY
ClipboardBlocked
CameraBlocked
MicrophoneBlocked
LocationBlocked
01

Guest access

Invitations belong to one browser. Guests require approval and begin in Watch mode.

Invitation lifetime
30 minutes
Control
Requires permission and Take control
Reconnection
Requires approval again
Host takeover
Holds guest input and resets guests to Watch
Revoke
Stops video and input; invalidates the invitation

Guest names are assigned by the host. They are not verified identities.

02

Session files

Each browser has a persistent folder. People sharing the browser share its files.

Outside paths and links
Rejected
Executable and script types
Rejected
Terminal and file execution
No operation exposed by BrowserSeat
File limits
20 MB per file; 100 MB and 200 files per browser
New text files
Up to 1 MB; existing files cannot be overwritten

Website uploads use the session picker. Downloads save in the session folder. Files remain after a guest disconnects.

03

Device permissions

Camera, microphone, location, system clipboard sharing and device permissions are disabled in the alpha.

04

Connection data

Normal direct sessions use encrypted WebRTC for browser video and control.

Host and guest
Video and permitted input travel between the devices
Connection service
Exchanges pairing details, including SDP and ICE metadata
Network metadata
Exposed during connection setup
Relay fallback
Not verified in this alpha

Direct connections can fail on restrictive networks.

WebRTC Security Architecture ↗
05

Current limits

File restrictions are enforced in application code. Browser pages use Chromium renderer sandboxing.

Full OS containment
Not implemented
Main process
Retains the owner’s OS permissions
Independent security audit
Not completed
Signed public installers
Not published
Verified platform
Windows development build

Guests can act inside signed-in websites. Use appropriate website account roles and trusted guests.

Electron sandbox model ↗