Security Architecture
WallMRR is engineered with hardware-grade security standards. Because you trust us with telemetry keys for your payment systems, our architecture is designed around least privilege, credential isolation, and unprivileged screen clients.
Defense-in-Depth Architecture
Our security model separates administrative control from telemetry consumption:
Encrypted Core
All external provider secrets encrypted with AES-256-GCM before reaching disk.
Zero Echo
API keys are write-only. They are never transmitted back to web browsers.
Dumb Screens
Television screens hold zero credentials and can only receive render payloads.
Credential Encryption at Rest
When you connect Stripe, RevenueCat, or Polar, your credentials never touch our database in plaintext:
- AES-256-GCM Envelope Encryption: Credentials are encrypted using authenticated 256-bit Galois/Counter Mode with unique 96-bit nonces per record.
- Zero Echo Policy: Once submitted, the plaintext key is stripped from memory. Our API endpoints only return public metadata (e.g.
keyTail: "...4812") to verify connection state. A compromise of a client session token will never reveal your underlying payment API keys. - Immediate Shredding on Disconnect: Clicking “Disconnect” in your dashboard executes a hard delete of the encrypted row in PostgreSQL.
Least-Privilege API Scopes
WallMRR is intentionally built to operate with read-only scopes. We never ask for full administrative or write permissions:
WallMRR only requires Read-only access to Subscriptions, Invoices, and Charges. We explicitly reject standard secret keys (sk_live_...) during creation when restricted keys are feasible.
Used strictly to query project metrics over the RevenueCat v2 metrics API.
Requires strictly the metrics:read and organizations:read permission scopes. Personal access tokens without organization context are rejected.
TV Pairing Protocol
Televisions mounted on office walls are often accessible in semi-public environments. Our screen pairing protocol is built specifically for this threat model:
- Short-Lived 6-Digit Codes: When a TV loads
wallmrr.com/tv, it generates an ephemeral pairing code with a strict 15-minute time-to-live (TTL). - Cryptographic Exchange: When claimed in your dashboard, the code is exchanged for an isolated, cryptographically random screen token.
- Zero Account Authority: Paired TV screens cannot modify settings, view billing, add integrations, or inspect API keys. Even if someone physically inspects the television browser's localStorage, they gain zero access to your WallMRR account.
- Instant Revocation: You can revoke any paired screen from your dashboard with one click, cutting off its real-time telemetry stream immediately.
Transport & Edge Protection
- TLS 1.3 Everywhere: All traffic between screens, clients, and our API is encrypted using modern TLS 1.3 with strict HSTS headers.
- Server-Sent Events (SSE): Real-time celebration telemetry flows over authenticated, encrypted SSE channels with heartbeat monitoring.
- No Third-Party Tracker Exfiltration: By eliminating third-party marketing tags and running cookieless analytics, there is zero risk of sensitive telemetry leaking to third-party ad networks.
Vulnerability Disclosure
We welcome responsible disclosure of security issues. If you identify a potential vulnerability, please report it directly to our security team:
Please do not disclose security issues publicly until we have had an opportunity to review and remediate the issue. We respond promptly to all security correspondence.