Skip to content

Security

How Nook keeps calls and accounts safe

An honest overview of the protections built into Nook, the limits of those protections and how to tell us about a problem.

  • Encrypted in transit
  • Not end-to-end encrypted
  • No recording
  • Permissions checked on the server

Accounts and sessions

  • Passwords are hashed with scrypt and a random salt per account. Nook never stores or logs the password itself.
  • Session cookies are httpOnly, SameSite=Lax and Secure on https (with the __Host- prefix), so page scripts can’t read them.
  • Sessions get a new token at every sign-in, expire after 30 days without use, and only a hash of the token is stored. You can sign out other devices in Settings → Security.
  • Rate limits slow down password guessing, sign-up floods, contact-form spam and abuse of call features. Limits are counted per IP address, which is stored only as a keyed hash.

The web app

  • Content Security Policy with a fresh nonce on every page: only Nook’s own scripts can run.
  • Security headers: framing is blocked, content types aren’t guessed, referrers are trimmed, camera and microphone are limited to Nook itself, and HSTS is sent on https.
  • Same-origin checks on every request that changes something, so other sites can’t act on your behalf.
  • Input validation on the server for every form and API call.

Calls and rooms

  • Server-side permissions: muting, removing, locking, admitting and ending a call are checked against the database on every request, whatever the interface shows.
  • Invite links carry a random key. Organizers can rotate it at any time, and old links stop working at once.
  • Access control: meetings can require a Nook account or an invitation, a waiting room lets hosts admit people one by one, and a locked room accepts no one new.
  • Media tokens are short-lived and issued by the server per participant, with permissions matching their role.

Integrations

  • messaging service webhook: every update must carry the secret token, compared in constant time. Each update is processed once, even if messaging service delivers it again.
  • messaging service linking uses one-time codes that expire after 10 minutes and are stored only as hashes.
  • LiveKit webhooks are accepted only with a valid signature.

Encryption and what it means

Audio and video travel between your browser and the media server over WebRTC, which encrypts media in transit with DTLS-SRTP. Pages and API calls use https when the server is set up with it.

Calls are not end-to-end encrypted. The media server (LiveKit) decrypts and forwards media to the other participants, so whoever operates the media server could technically access it. Nook has no recording feature and doesn’t store audio or video.

If your conversations need end-to-end encryption, Nook isn’t the right tool for them today.

What we don’t claim

  • No certifications or audits. Nook hasn’t been through a third-party security audit or certification such as ISO 27001 or SOC 2.
  • No bug bounty program. We’re grateful for reports, but there are no paid rewards.
  • Each server is run by its operator. How well a Nook server is maintained — updates, backups, https, secrets — depends on who runs it.

Reporting a security problem

If you think you’ve found a vulnerability, please tell us privately first so it can be fixed before it’s widely known.

Security contact: security email to be completed before publication

You can also use the contact form with the topic “Security”.

Please don’t access other people’s data, disrupt calls or run automated scans against servers you don’t operate. Act in good faith and we’ll work with you to understand and fix the issue.

Helpful to include

  1. What you found and the steps to reproduce it
  2. What an attacker could do with it
  3. How to reach you for follow-up questions

Your data

What Nook stores, for how long, and how to export or delete it: