Network Sharing and Security

FrameDeck runs a small web server on your computer (port 47820, or the next free port) so display windows, tablets, phones, NZXT CAM and kiosks can load your screens.

Network sharing

• Off (default): only this computer can reach FrameDeck.
• On (Settings → Share displays on my network): phones, tablets and other computers on your network can open display links.

Even with sharing on:

• The editor and everything that changes settings work only from the computer FrameDeck runs on. Other devices can view screens, not edit them.
• Requests from other devices can only fetch public internet addresses, so a shared display can't be used to probe your network. The address is checked at the moment of connecting, so DNS tricks can't swap in a private one. Built-in widgets on this computer can still reach local services (for example Home Assistant or a Pi).
• FrameDeck only answers to its own addresses (localhost, IP addresses, or this computer's name) and rejects API calls from other websites, so a web page can't trick your browser into talking to it ("DNS rebinding").
• Phones and tablets can use a screen's tap-to-use widgets (log water, tick habits, run the pomodoro), and nothing else.
• Calendar and news-feed links are hidden from other devices. They get a reference instead, and FrameDeck fetches the feed for them, so a private iCal link never leaves your computer.

While sharing is on, anyone on your network can still see the rest of your screens' layouts and settings, including the code and settings of your own widgets. Use it on networks you trust (home, not café Wi-Fi).

Custom widgets

Widgets you write or import run in a sandbox: they can't touch your layouts or files, can't call FrameDeck directly, and can only load data from public internet addresses, not your local network. Built-in widgets you've edited count as your own widgets here.

Links, windows and web pages

Links in widgets (a news feed's "Open article") only ever open web pages in your browser, never files or programs. Web pages shown in widgets can't use your camera, microphone, location or notifications.

Imports

When you import a layout, preset or widget, FrameDeck asks first if it contains code, or if it points at devices on your own network (like a router or NAS): a shared file could otherwise make FrameDeck contact them from your computer.

Advanced protection

Settings → Advanced protection lets you turn off three protections if they get in your way:

• Keep custom widgets and skins off my local network: turn off to let your own widgets reach Home Assistant, a NAS or a Pi.
• Warn me about risky imports: turn off to import without being asked.
• Block camera, microphone and location for web pages.

Turning one off asks you to confirm, because your computer is easier to attack while it's off. Turn it back on when you're done. Other protections can't be turned off.

Updates

Settings → Check for updates tells you when a new version is out, since new versions include security fixes.

Your data

Layouts, uploaded pictures and videos, and your supporter key are stored in FrameDeck's data folder (Help → Open Data Folder) and never leave your computer. FrameDeck contacts only the services your widgets use: Open-Meteo (weather, air quality, city search), Hacker News, CoinGecko, ESPN (scores), and any feed or calendar address you enter.

Reporting a security problem

Please don't open a public issue. Use GitHub's private vulnerability reporting.