Security model

What Nuvo protects against

• Another user on the machine reading your library or cache.
• Another process reaching the daemon.
• A web page, a pasted link or a downloaded theme running code or fetching data in the app.
• A stolen disk image or backup of your data.

What it does not protect against

• Code running as you with your unlocked keyring. It can ask the keyring for the master key.
• A compromised system, or root on the machine.

The daemon

• It listens on a unix socket, not a network port. The directory is mode 0700, the socket 0600.
• Every route needs a per-launch bearer token. The comparison takes constant time.
• Library data is encrypted with SQLCipher. Cached audio is encrypted per chunk.
• The log records routes, never ids.
• Remote fetches follow a deny-by-default rule: https, a host on the allowed list, no credentials, no custom port, and public addresses only. Redirects get the same check.
• Proxy URLs accept http, https, socks5 and socks5h, with an explicit port. Credentials go to child processes through environment variables, not arguments.
• Local files: links inside a music folder are never followed, and a file must stay inside its folder when opened.
• The translator endpoint must be on loopback, its path is fixed, and redirects are not followed.
• Exports read explicit columns only. They never include settings, tokens, the recovery data or cache paths.
• A support report copies versions, daemon state and the last network check. It contains no library, paths or passwords.

The window

• A content security policy allows scripts only from the app itself. Frames, objects and forms are off. Images, media and connections are limited to the hosts Nuvo needs: YouTube, SoundCloud, the lookup APIs for pasted links and the import sources.
• The window never gets the daemon token. It calls nuvo-core:// URLs, and main forwards them.
• Main checks the input of every file and export channel. Paths come from system dialogs, not from the page.
• Permissions are limited to audio devices, speaker selection, clipboard writes and full screen, and only for the app’s own page.
• Custom CSS and theme files pass a strict checker. Nothing in them can fetch resources or cover the page in a way that blocks clicks. See themes and custom CSS.
• Fonts load only through main’s own handler.

Privacy

• No account, no Nuvo server, no analytics from Nuvo.
• Nuvo talks to YouTube, SoundCloud and LRCLIB to do its job, plus the public APIs of services whose links you paste. Your recommendations are computed locally.
• A network check lists exactly which hosts it contacts.

Reporting a problem

See the security policy.