Device Test Bench is a 100% client-side application. It does not collect, store, transmit, log, or analyze any user data, media, or metadata. There is no backend, no database, no analytics, and no telemetry. The application runs entirely in your browser tab.

The single page-load network request returns only static HTML, CSS, JavaScript, and a tiny inlined SVG favicon. After that, the page makes no additional network calls (verified by E2E tests).

• Requests camera and microphone permissions only after you click Start on a test card.
• Uses the resulting MediaStream to:
  • Attach a <video> element (camera preview), and/or
  • Pipe into an AnalyserNode to drive a VU meter, and/or
  • Pipe into a MediaRecorder to produce a .webm Blob when you click Record.
• Offers the resulting Blob/image as a downloadable file via URL.createObjectURL and a normal <a download> link.
• Releases every MediaStreamTrack on unmount and every URL.createObjectURL on completion/unmount.

• No fetch/XHR/WebSocket calls to any host.
• No localStorage/sessionStorage/IndexedDB/Cookies.
• No service worker, no background sync, no push notifications.
• No third-party scripts, no analytics, no A/B testing, no error-reporting SDK.
• No use of eval, new Function, or dangerouslySetInnerHTML.
• No telemetry in the build pipeline (no source maps shipped to the browser by default).
• No fonts, images, or scripts loaded from CDNs.

• The user's own browser, OS, or extensions. A malicious browser extension could in principle read media from the page. This is true of any web app.
• Compromise of the user's machine. If your OS or browser is compromised, no web page is safe.
• Phishing: someone could clone this site. Always verify the URL.

If you find a security issue, please open a private GitHub Security Advisory: https://github.com/arth2o/camera-mic-device-test-bench/security/advisories/new.

If you prefer email, open a GitHub issue asking for a security contact and we will respond with one. (We do not publish a security email by default to avoid spam.)

We will acknowledge new reports within 7 days and aim to ship a fix within 30 days for high-severity issues.

We do not run a paid bug-bounty program. Contributors who report valid issues are credited in the release notes (with permission).

This project follows Semantic Versioning. Security fixes are released as patch versions and disclosed in the GitHub Releases page.