ButtonHub

Security

If you think you have found a security problem in ButtonHub, the relay, or this website, email [email protected]. Say what you found and how to reproduce it. Please give us a chance to fix it before telling anybody else.

There is no bounty. There is a person who reads the mail and will tell you what happened.

Show control, not a safety system

ButtonHub is built for live production and is reliable enough to run shows on. What it is not is a safety system. It does not replace trained crew, a working procedure, or somebody who can see the stage.

Never make it the only thing standing between a person and a moving, hot, heavy or loud piece of equipment. Redundancy here means a second Mac can take over. It does not mean nothing can go wrong.

How access works

• Every crew link is PIN locked, and each link carries only its own buttons.
• Failed PIN attempts are slowed by a delay that grows. It is a delay, never a lockout, because a link that locks itself out mid-show is worse than the thing it defends against.
• A link published to the internet carries a long random token in its address. A link without one is not published and cannot be reached from outside.
• The admin editor and the QR code sheet never serve over the internet at all.
• Companion is never exposed to the phones. ButtonHub talks to it, not them.

Treat the links like keys

A QR code, a PIN or a published link is a key to your rig. Give them only to people you trust with the kit, and retire links when phones leave the building.