Security & Disclosure

This page describes how DemoLens is secured and how to report a problem if you find one.

Your recordings never reach us

Screen capture, compositing and encoding happen entirely in your browser, and the finished file is written to your machine. There is no upload step and no server-side copy — which means a breach of our systems could not expose a recording, because we never hold one.

Accounts

Sign-in is handled by Google OAuth, so we never see or store a password. Sessions are held in cookies that are not readable by page scripts and are sent only over HTTPS.

Pro entitlements

Pro access is delivered to the extension as a short-lived token signed with ES256 and verified against a public key built into the extension. The extension re-checks that signature every time it reads the token, so a forged or edited entitlement is rejected rather than trusted. Tokens expire within a day and are refreshed, which is also how access is withdrawn: revoking a device from your dashboard stops it refreshing.

Payments

Card details go directly to Razorpay and never touch our servers. Incoming payment webhooks are verified with an HMAC signature, compared in constant time, and processed exactly once through an idempotency ledger, so a replayed or forged callback cannot alter a subscription.

The desktop helper

The helper communicates only with the DemoLens extension, over a channel the operating system restricts to that one extension by id. It sends cursor position, left clicks and the zoom shortcut, and nothing else — typed content is never examined or transmitted. Helper updates are downloaded over HTTPS and verified against an ed25519 signature from our publishing key before they are installed, so a tampered or unsigned update is refused.

This site

The site is served over HTTPS with HSTS, a Content-Security-Policy restricting where scripts and connections may come from, and framing disabled. Endpoints that return tokens or personal data are marked no-store so no shared cache retains them, and cross-origin access to extension-facing endpoints is restricted to our own extension.

Reporting a vulnerability

Email getdemolens@gmail.com with "Security" in the subject. Please include enough detail to reproduce the issue, and give us a reasonable opportunity to fix it before disclosing publicly. We will acknowledge your report, keep you updated, and credit you when a fix ships if you would like us to.

Please do not run automated scanners against the live service, access or modify data that is not yours, or degrade the service for other users while testing. We will not pursue action against good-faith research that follows these guidelines.

We do not currently run a paid bug-bounty programme.