Skip to content

v0.5.2 — authenticated local sidecar

Choose a tag to compare

View all tags
@latent-variable latent-variable released this 26 Jun 18:15
v0.5.2
c71ce21

Security release. Closes two P1 auditor findings on the loopback TTS backend (127.0.0.1:8766):

  • #14 CSRF — a website could fire a cross-origin POST to mutating endpoints (e.g. the multi-GB HD install). Now blocked: a shared-secret Bearer token is required and browser-origin requests are rejected.
  • #13 impostor — a process squatting the port could be reused and receive captured selected text. The app now verifies the backend via an HMAC /verify challenge before trusting it; a process that can't read the 0600 token file can't forge the proof.

Token is per-machine in a 0600 file (app + backend read-or-create it); nothing shipped, fully local as always. Upgrades reclaim a stale pre-auth backend automatically.

Install: brew upgrade --cask latent-variable/tap/yap, or download the DMG and xattr -cr /Applications/Yap.app.

Assets 3
Loading