Security

What the application does on the computer

The desktop application runs on Windows. The in-game overlay is drawn over the game window.

• Game data is read only from official local sources provided by the games: Game State Integration for CS2 and Dota on 127.0.0.1, the combat log file of World of Warcraft and the shared memory of iRacing.
• These sources are read only on the same computer.
• Screen sharing, game sharing and clip recording happen only when the player turns them on.
• Game clips are stored locally on the computer.

What the application does not do

• It has no kernel driver.
• It does not inject code into game processes.
• It does not read the memory of other programs. The only exception is the shared memory that iRacing publishes for this purpose through its SDK.
• It does not run with administrator rights.

Updates

Every update is cryptographically signed (minisign, through the Tauri updater). The application refuses an update whose signature does not match the key built into it.

Updates are downloaded over HTTPS from GitHub Releases.

Accounts

• Passwords are never stored by TeamBase in plain text. Authentication is handled by Supabase Auth, which stores passwords hashed with bcrypt.
• Login goes through a server function that uses a CAPTCHA (Cloudflare Turnstile), rate limiting and email verification of new devices.
• At registration and at password change, the password is checked against the Have I Been Pwned database of leaked passwords using the k-anonymity method.

Data access

• Access rules are enforced on the server, in the database, through row-level security. The application cannot read private messages, guilds or channels that the server does not allow.
• Voice runs on LiveKit (WebRTC) and is encrypted in transit.
• Game sharing between friends is peer-to-peer.

Testing and reviews

Thousands of automated tests run before each release. The desktop application has about 1,200 backend tests and about 3,900 frontend tests.

TeamBase also performs internal security reviews. The latest one, on 14 October 2026, covered the database rules, the server functions, the desktop application and the website. The issues it found were fixed in version 0.1.96.

Limits

The source code is not open. No independent external audit has been carried out yet. One is planned once the number of users grows. Until then, reports from outside are welcome.

Reporting a vulnerability

Reports go to support@teambase.lol. Please describe the issue and the steps needed to reproduce it.

• Please do not test on accounts or data of other users.
• Please do not run denial-of-service attacks.
• A response is sent within a few days.
• If the reporter wishes, credit is given in the changelog.