Please report security issues privately through GitHub's security advisory form rather than opening a public issue.
BepChat has no accounts, no database and no user data — the overlay URL is the entire configuration. The interesting attack surface is therefore:
- Server-side request forgery. Channel identifiers from the query string are
interpolated into upstream fetch URLs. They are validated fail-closed in
shared/identifiers.mjs; a bypass is a vulnerability. - Cross-site scripting in the overlay. Emote, badge and paint data comes
from third-party APIs keyed by an attacker-supplied channel name. The message
path builds DOM nodes rather than HTML, and image URLs are restricted to an
allowlist of CDN hosts in
public/overlay/render.mjs. - Resource exhaustion. The relay caps concurrent rooms, total viewers and viewers per address, and rate-limits the JSON endpoints. A way to exceed those caps, or to make one request open unbounded upstream connections, is in scope.
- The YouTube and TikTok integrations depend on undocumented third-party endpoints and can break when those change. That is a bug, not a vulnerability.
- Chat content itself is untrusted by design and rendered as text.
- Self-hosted instances that set
TRUST_PROXY=1without an actual reverse proxy in front are misconfigured; the per-IP limits cannot hold in that case.