Security Overview

Security is built into the core architecture of EcosystemBridge. Because we do not use the cloud, your attack surface is drastically reduced.

1. Local Network Isolation

EcosystemBridge does not punch holes in your router or use external STUN/TURN servers. All communication happens via 127.0.0.1 and your LAN IP. Someone outside your house cannot access your phone.

2. Secure QR Pairing Protocol

Pairing is secured using a one-time, short-lived cryptographic token.

The Windows PC generates a secret token valid for 5 minutes.
You scan the QR code with your phone.
The phone sends the token to the PC to prove you physically have both devices.
The PC issues a persistent, unique Auth Token to the phone.

All future connections require this Auth Token. If an unknown device tries to connect, the connection is instantly rejected (HTTP 403 Forbidden).

3. WebSocket Authorization

Every single WebSocket frame and HTTP API request made between your phone and PC is authenticated. The paired Auth Token must be present in the request headers or query parameters.

4. Zero Telemetry

We do not collect crash reports, usage analytics, or IP addresses. The code contains no telemetry SDKs.

5. Video & Screen Sharing Security

When you use the Webcam or Screen Mirror features, the video is encoded using hardware acceleration (H.264) and sent via raw UDP directly to your PC's local IP. It is never uploaded to the internet. When you click "Stop", the hardware encoder is instantly destroyed.