Security

Collaborating in TouchDesigner means letting other people change your project, and a TouchDesigner project runs Python. This page says what that trusts, how each way of connecting is protected, and how to tell us about a problem.

A room is people who trust each other

• Your partners can run code on your machine. What they change includes Python expressions and DAT text, and every message names the TDXCollab handler that applies it. Work only with people you would hand your project to.
• The room secret is saved in your project. Anyone you give the .toe can join its room. Change or clear Room Secret before you share a project file.
• Copies that differ are reported. The integrity check names the operators that differ between partners, and you choose whose copy everyone takes. A zone that is replaced is kept, so it can be restored on your side.

Keeping others out

• Relay rooms need a code and a secret; the relay turns away anyone without both. The secret travels only in the first message, never in the address, and the hosted relay stores just its SHA-256 hash.
• Direct connections have no secret: anyone who can reach the server's port can connect. Use them on a network you trust or over a VPN.
• Mismatched builds refuse to pair: a relay room takes one protocol version.
• The hosted relay limits how many messages each connection sends a second and closes a connection that floods it.

Encryption in transit

• Hosted relay: TLS (wss://) between every TouchDesigner and the relay.
• Self-hosted relay: TLS on Cloudflare; the Python relay speaks plain ws:// for now, so keep it on a trusted network until TLS and an access key land.
• Direct: plain TCP, unencrypted. A VPN encrypts it for you.

Messages are not end-to-end encrypted yet: the relay passes them on without storing or logging them, but its operator could technically read them in transit. Encrypting each message with a key derived from the room secret, so the relay sees only who sends to whom, is planned.

Reporting a vulnerability

Write to dan+tdxcollab@functionstore.xyz with "Security" in the subject: what you found, how to reproduce it, and which version. Please give us a chance to fix it before you publish. This contact is also in /.well-known/security.txt.

This website

The site is static: no forms, no accounts, no cookies. It is served over HTTPS with headers that keep it from being framed or loading code from anywhere else.

Last updated 13 October 2026.