The Signal Share Companion bridge is designed with several security layers to keep your PC safe.
The bridge binds only to 127.0.0.1. It is not accessible from other devices on your network or the internet.
Only requests from the official Signal Share domain or localhost are allowed to communicate with the bridge.
Every action (Play, Pause, Skip) requires a local secret token stored in your browser's private storage.
The ability to open arbitrary links is disabled by default to prevent malicious URL injection from external sources.
Commands are rate-limited to 30 requests per minute to prevent automated spamming of your system media controls.
The companion should never be run as an Administrator. It runs with your normal user permissions for maximum safety.
The bridge port is not exposed through UPnP or firewall rules automatically, keeping your network perimeter secure.
Remote control via Supabase is disabled by default and requires explicit user activation with a valid User ID.