SECURITY DETAILS

What your Mac is actually exposing, and to whom.

The model in one paragraph

DeckPad runs a small web server on your Mac, bound to your local network. Paired devices load a web page from it and send it button taps. The server treats every request as untrusted: it only ever performs actions that already exist in its own local configuration, written by you, on your Mac. A request can say "run button 7". It can never say what button 7 does.

Execution

• The Mac only runs button actions already present in its local configuration: apps, Shortcuts, websites, media, volume, keystrokes, snippets, system actions, widgets, and sequences. Requests name a button ID, never an arbitrary command or shell string.
• Unknown button IDs are rejected. The live app-switch feature only accepts apps from the list the Mac itself published seconds earlier, and only activates already-running apps.

Pairing & auth

• Pairing requires a 6-digit code shown on the Mac: single-use, 5-minute expiry, 5 attempts, and it only exists while the pairing window is open.
• Each device gets its own random 128-bit key, required on every sensitive request and compared in constant time. Revoke any device from the menu bar; revocation is immediate.

Network hardening

• Host-header allowlist defeats DNS-rebinding (a malicious website can't point its own domain at your Mac).
• Mutating endpoints require a JSON content type plus the key header, which HTML forms cannot produce. That closes form-based CSRF.
• Request bodies are capped at 4 KB, declared length is checked before reading, and the server keeps small buffers.

What DeckPad never does

• No cloud, no accounts, no telemetry, no analytics, no phoning home. The one network call the app ever makes to the internet is the license activation you trigger yourself (and website-icon fetches for buttons you configured).

Everything above is about the app on your Mac. This website is a different thing and it does use Google Analytics, so page visits are measured here. Saying otherwise while a tag sits in the page would make the rest of this page worth less.

The honest tradeoff

Traffic on your LAN is plain HTTP. This is deliberate: DeckPad exists to revive very old devices, and self-signed TLS certificates are exactly what those old browsers cannot handle. Consequence: someone who can already read your Wi-Fi traffic could observe deck traffic and capture a device key. On a home network you trust, that is a reasonable tradeoff; on hostile or shared Wi-Fi, don't pair. You can rotate any key at any time by revoking the device and re-pairing in ten seconds.

Found something? Please write: support@deckpad.app. Security reports get answered first.