The CLI runs locally. It sends requests only to Twitch playback services, Twitch VOD CDN domains, tracker sites, and Twitch's chat GraphQL endpoint when you archive a chat replay. It does not require account cookies or OAuth credentials.
The watch command starts a local player server. That server binds to
127.0.0.1, uses a random capability path, checks Host and Origin, only
proxies media URLs on Twitch's CDN allowlist, and never exposes playback
credentials to the browser. For the page it also fetches emote, badge and
channel images from static-cdn.jtvnw.net, by validated ID and without
following redirects, and asks Twitch's GraphQL endpoint for the channel's
badges and the broadcast's title, category and chapters.
Chats lean on three third-party emote services, so watch contacts them too
once a chat is shown: the emote lists of api.betterttv.net,
api.frankerfacez.com and 7tv.io, requested with the channel's public
Twitch user ID, and the images on cdn.betterttv.net, cdn.frankerfacez.com
and cdn.7tv.app. Those requests carry no credentials, do not follow
redirects, and their answers are size-limited and validated before use. Do
not expose the server to a network.
Do not open a public issue for a vulnerability that exposes credentials or allows remote code execution. Use GitHub's private security advisory feature for this repository instead.
Include the affected version, operating system, reproduction steps, impact, and any suggested mitigation. Remove playback tokens, cookies, local paths, and personal information from logs.
These files are ignored by Git and must remain private:
.envclient_secret*.json- exported browser cookies
Public Twitch playback URLs can contain short-lived signed tokens. Treat them as temporary credentials and avoid posting them in issues.